theory Arch_DR

lemma decode_invocation_archcap_corres:
  notes label_split_asm = invocation_label.split_asm gen_invocation_labels.split_asm
                          arch_invocation_label.split_asm
  shows
  "\<lbrakk> Some intent = transform_intent (invocation_type label') args';
     invoked_cap_ref = transform_cslot_ptr invoked_cap_ref';
     invoked_cap = transform_cap invoked_cap';
     excaps = transform_cap_list excaps';
     invoked_cap' = cap.ArchObjectCap x \<rbrakk> \<Longrightarrow>
    dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = Invocations_A.InvokeArchObject ai
                       \<and> arch_invocation_relation rv ai))
         \<top> (invs and valid_etcbs and valid_cap invoked_cap'
                 and (\<lambda>s. \<forall>x \<in> set (map fst excaps'). s \<turnstile> x)
                 and (\<lambda>s. \<forall>x \<in> set excaps'. cte_wp_at ((=) (fst x)) (snd x) s))
        (Decode_D.decode_invocation invoked_cap invoked_cap_ref excaps intent)
        (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' invoked_cap' excaps')" apply (rule_tac F="\<forall>x \<in> set (map fst excaps'). cap_aligned x" in corres_req) apply (fastforce simp add: valid_cap_aligned) apply clarsimp proof (induct x) case (ASIDPoolCap ap_ptr asid) thus ?case apply (simp add: Decode_D.decode_invocation_def
                     decode_invocation_def arch_decode_invocation_def
               split del: if_split) apply (clarsimp simp: get_asid_pool_intent_def transform_intent_def
                          map_option_Some_eq2 throw_opt_def
                          decode_asid_pool_invocation_def
               split del: if_split split: label_split_asm list.split_asm) apply (simp add: split_beta corres_alternate2
                     liftE_bindE corres_symb_exec_in_gets
                     corres_whenE_throwError_split_rhs
                     split: cap.split arch_cap.split option.split) apply (clarsimp simp: get_index_def transform_cap_list_def
                          throw_on_none_def split_beta bindE_assoc
                          dc_def[symmetric]) apply (rule corres_guard_imp) apply (rule corres_symb_exec_r) apply (clarsimp simp: corres_whenE_throwError_split_rhs
                               corres_alternate2) apply (rule corres_alternate1) apply (simp add: select_ext_def bind_assoc) apply (rule dcorres_symb_exec_r) apply (rule corres_assert_rhs) apply (rule_tac x="unat (free_asid_pool_select pool asid)" in select_pick_corres_asm) apply (rule CollectI) apply (elim conjE) apply (rule le_p2_minus_1) apply (rule unat_le_helper) apply (simp add: p2_low_bits_max) apply (rule corres_returnOk[where P=\<top> and P'="\<lambda>rv. is_aligned asid asid_low_bits"]) apply (clarsimp simp:arch_invocation_relation_def translate_arch_invocation_def
                                transform_asid_def asid_high_bits_of_def shiftr_irrelevant
                                up_ucast_inj_eq) apply (erule impE) apply (rule arg_cong[where f=ucast]) apply (subst shiftr_irrelevant) apply (rule word_leq_minus_one_le) apply (simp add: asid_low_bits_def) apply (subst ucast_le_migrate) apply (simp add: asid_low_bits_def word_size) apply (simp add: word_size) apply (subst ucast_down_minus) apply (simp add: is_down_def target_size_def source_size_def word_size) apply (simp add: asid_low_bits_def) apply simp apply simp apply (simp add: ucast_ucast_add) apply (erule_tac P="ucast asid = 0" in notE) apply (rule ucast_up_inj[where 'b=32]) apply (simp add: ucast_ucast_mask is_aligned_mask asid_low_bits_def) apply simp apply (wp | simp add:valid_cap_def split del: if_split)+ done next case ASIDControlCap thus ?case apply (simp add: Decode_D.decode_invocation_def
                     decode_invocation_def arch_decode_invocation_def
                     bindE_assoc
               split del: if_split) apply (clarsimp simp: get_asid_control_intent_def transform_intent_def
                          map_option_Some_eq2 throw_opt_def
                          decode_asid_control_invocation_def
                          transform_cnode_index_and_depth_def
               split del: if_split split: label_split_asm list.split_asm) apply (simp add: split_beta corres_alternate2
                     liftE_bindE corres_symb_exec_in_gets
                     corres_whenE_throwError_split_rhs
                     transform_cnode_index_and_depth_def
                     select_ignored
              split: cap.split arch_cap.split option.split) apply (clarsimp simp: get_index_def transform_cap_list_def
                          throw_on_none_def split_beta bindE_assoc
                          dc_def[symmetric]) apply (intro conjI impI allI) apply (rule corres_symb_exec_r[OF dcorres_alternative_throw],
                      (wp | simp)+) defer apply ((rule corres_symb_exec_r[OF dcorres_alternative_throw],
                     (wp | simp)+)+)[11] apply (rename_tac dev ptr sz v) apply (case_tac dev) apply simp apply (rule corres_alternate2) apply (rule corres_guard_imp) apply (rule corres_symb_exec_r) apply (rule dcorres_throw) apply ((wp|simp)+)[5] apply clarsimp apply (rule conjI[rotated]) apply clarsimp apply (rule corres_alternate2) apply (rule corres_guard_imp) apply (rule corres_symb_exec_r) apply (rule dcorres_throw) apply ((wp|simp)+)[5] apply clarsimp apply (rule corres_guard_imp) apply (rule corres_alternate1) apply (clarsimp simp: select_ext_def bind_assoc) apply (rule dcorres_symb_exec_r) apply (rule corres_assert_rhs) apply (rule_tac x="unat (free_asid_select v)" in select_pick_corres_asm) apply (rule CollectI) apply (elim conjE) apply (rule le_p2_minus_1) apply (rule unat_le_helper) apply simp apply (simp add:bindE_assoc) apply (rule corres_splitEE[OF dcorres_ensure_no_children[where P="(\<noteq>) cap.NullCap"]]) apply (rule corres_splitEE) apply (rule lookup_slot_for_cnode_op_corres; simp) apply (simp, elim conjE) apply (rule corres_splitEE[OF dcorres_ensure_empty]) apply (rule corres_returnOk[where P=\<top> and P'=\<top>]) apply (simp add:transform_def arch_invocation_relation_def
                              translate_arch_invocation_def) apply (simp add:transform_asid_def unat_ucast asid_high_bits_def asid_low_bits_def
                              unat_lt2p[where 'a=8, simplified]) apply (thin_tac "free_asid_select v \<notin> dom v") apply clarsimp apply (subgoal_tac "unat ((ucast (free_asid_select v) :: word32) << 10) mod 1024=0") apply (simp add: asid_high_bits_of_shift[simplified asid_low_bits_def]) apply (rule shiftl_mod[where n=10, simplified]) apply (cut_tac x="free_asid_select v" and 'a=32 in ucast_less) apply simp apply (rule less_trans) apply simp apply simp apply (wp lsfco_not_idle select_inv | simp)+ apply (simp add: cte_wp_at_caps_of_state neq_Nil_conv invs_mdb_cte mdb_cte_at_rewrite) apply auto done next case (PageCap dev base rights pgsz asid) thus ?case supply option.case_cong[cong] if_cong[cong] apply (simp add: Decode_D.decode_invocation_def
                     decode_invocation_def arch_decode_invocation_def
               split del: if_split) apply (clarsimp simp: get_page_intent_def transform_intent_def
                          map_option_Some_eq2 throw_opt_def
                          decode_page_invocation_def
                          transform_intent_page_map_def
               split del: if_split split: label_split_asm list.split_asm,
            simp_all add: split_beta corres_alternate2
                          liftE_bindE corres_symb_exec_in_gets
                          corres_whenE_throwError_split_rhs
                          transform_cnode_index_and_depth_def
                          select_ignored throw_on_none_def
                          get_index_def transform_cap_list_def
                          dc_def[symmetric]
                   split: cap.split arch_cap.split option.split) 
              (* 45 subgoals, most are irrelevant invocations *)
                apply (clarsimp simp: gets_bind_alternative gets_the_def bind_assoc
                                     corres_symb_exec_in_gets assert_opt_def) apply ((clarsimp simp: neq_Nil_conv valid_cap_simps obj_at_def
                                      opt_object_page_directory invs_valid_idle
                                      label_to_flush_type_def isPageFlushLabel_def
                               dest!: a_type_pdD)+)[35] 
             (* 10 subgoals *)
             (* PageMap *)
              apply (clarsimp simp: transform_mapping_def) apply (clarsimp simp: neq_Nil_conv valid_cap_simps obj_at_def opt_object_page_directory
                                   invs_valid_idle label_to_flush_type_def isPageFlushLabel_def
                            dest!: a_type_pdD) apply (intro conjI; clarsimp) 
              (* Unmapped *)
               apply (rule_tac
                       r'=dc and P'="I" and Q'="\<lambda>rv. I and (\<exists>\<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits))"
                       for I
                       in corres_alternative_throw_splitE[OF _ _ returnOk_wp[where x="()"], simplified]) apply (rule corres_from_rdonly, simp_all)[1] apply (wp+ | simp)+ apply (rule hoare_strengthen_post, rule hoare_post_taut) apply (rename_tac rv s) apply (case_tac rv, auto simp add: in_monad)[1] apply (simp add: corres_whenE_throwError_split_rhs corres_alternate2
                                  check_vp_alignment_def unlessE_whenE) apply (clarsimp simp add: liftE_bindE[symmetric]) apply (rule corres_alternative_throw_splitE) apply (rule corres_alternate1) apply (rule corres_guard_imp,
                             rule create_mapping_entries_dcorres[OF refl]) apply (clarsimp simp: neq_Nil_conv cap_aligned_def
                                                pd_bits_def pageBits_def) apply (simp add: vmsz_aligned_def) apply (simp only: linorder_not_le, erule order_le_less_trans[rotated]) apply simp apply simp apply (fastforce simp: neq_Nil_conv valid_cap_simps dest!: page_directory_at_rev) apply (rule corres_from_rdonly[where P=\<top> and P'=\<top>], simp_all)[1] apply (wp+ | simp)+ apply (rule validE_cases_valid, rule hoare_pre) apply (wp+ | simp)+ apply (clarsimp simp add: in_monad conj_disj_distribR[symmetric]) apply (simp add: conj_disj_distribR cong: conj_cong) apply (simp add: arch_invocation_relation_def translate_arch_invocation_def
                                      transform_page_inv_def update_cap_rights_def
                                      update_mapping_cap_status_def Types_D.cap_rights_def
                                      mask_vm_rights_def transform_mapping_def) apply wp+ apply simp apply (rule hoare_pre, wp, auto)[1] apply ((wpsimp simp: whenE_def split_del: if_split)+)[2] 
             (* Mapped *)
              apply (clarsimp simp: bindE_assoc) apply (clarsimp simp: corres_whenE_throwError_split_rhs corres_alternate2) apply (rule_tac
                      r'=dc and P'="I" and Q'="\<lambda>rv. I and (\<exists>\<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits))"
                      for I
                      in corres_alternative_throw_splitE[OF _ _ returnOk_wp[where x="()"], simplified]) apply (rule corres_from_rdonly, simp_all)[1] apply (wp+ | simp)+ apply (rule hoare_strengthen_post, rule hoare_post_taut) apply (rename_tac rv s) apply (case_tac rv, auto simp add: in_monad)[1] apply (simp add: corres_whenE_throwError_split_rhs corres_alternate2
                                 check_vp_alignment_def unlessE_whenE) apply (clarsimp simp add: liftE_bindE[symmetric]) apply (rule corres_alternative_throw_splitE) apply (rule corres_alternate1) apply (rule corres_guard_imp[where P=P and Q=P and Q'="P' and _" and P'=P' for P P']) apply (rule_tac F="x21 < kernel_base" in corres_gen_asm2) apply (rule corres_guard_imp,
                              rule create_mapping_entries_dcorres[OF refl]) apply (clarsimp simp: neq_Nil_conv cap_aligned_def
                                                 pd_bits_def pageBits_def) apply (simp add: vmsz_aligned_def) apply simp apply simp apply simp apply (fastforce simp: neq_Nil_conv valid_cap_simps dest!:page_directory_at_rev) apply presburger apply blast apply (rule corres_from_rdonly[where P=\<top> and P'=\<top>], simp_all)[1] apply (wp+ | simp)+ apply (rule validE_cases_valid, rule hoare_pre) apply (wp+ | simp)+ apply (clarsimp simp add: in_monad conj_disj_distribR[symmetric]) apply (simp add: conj_disj_distribR cong: conj_cong) apply (simp add: arch_invocation_relation_def translate_arch_invocation_def
                                     transform_page_inv_def update_cap_rights_def
                                     update_mapping_cap_status_def Types_D.cap_rights_def
                                     mask_vm_rights_def transform_mapping_def) apply wp+ apply (simp) apply (rule hoare_pre, wp, auto)[1] apply (wp | simp add: whenE_def split del: if_split)+ 
            (* PageUnmap *)
             apply (rule corres_alternate1) apply (simp add: returnOk_def arch_invocation_relation_def
                             translate_arch_invocation_def transform_page_inv_def) 
           (* PageClean *)
            apply (clarsimp) apply (rule corres_from_rdonly) apply (wp, clarsimp) apply (simp only: Let_unfold, (wp whenE_inv)+, clarsimp) apply (rule validE_cases_valid, rule hoare_pre) apply (wpsimp simp: Let_unfold arch_invocation_relation_def
                                 translate_arch_invocation_def transform_page_inv_def)+ apply (clarsimp simp: in_monad conj_disj_distribR[symmetric]) apply safe apply blast apply (metis flush.exhaust) 
                 (* PageInvalidate *)
                  apply (rule corres_from_rdonly) apply (wp, clarsimp) apply (simp only: Let_unfold, (wp whenE_inv)+, clarsimp) apply (rule validE_cases_valid, rule hoare_pre) apply (wpsimp simp: Let_unfold arch_invocation_relation_def
                                       translate_arch_invocation_def transform_page_inv_def)+ apply (clarsimp simp: in_monad conj_disj_distribR[symmetric]) apply safe apply blast apply (metis flush.exhaust) 
                (* PageCleanInvalidate *)
                 apply (rule corres_from_rdonly) apply (wp, clarsimp) apply (simp only: Let_unfold, (wp whenE_inv)+, clarsimp) apply (rule validE_cases_valid, rule hoare_pre) apply (wpsimp simp: Let_unfold arch_invocation_relation_def
                                      translate_arch_invocation_def transform_page_inv_def)+ apply (clarsimp simp: in_monad conj_disj_distribR[symmetric]) apply safe apply blast apply (metis flush.exhaust) 
               (* PageUnify *)
                apply (rule corres_from_rdonly) apply (wp, clarsimp) apply (simp only: Let_unfold, (wp whenE_inv)+, clarsimp) apply (rule validE_cases_valid, rule hoare_pre) apply (wpsimp simp: Let_unfold arch_invocation_relation_def
                                     translate_arch_invocation_def transform_page_inv_def)+ apply (clarsimp simp: in_monad conj_disj_distribR[symmetric]) apply safe apply blast apply (metis flush.exhaust) 
              (* PageGetAddress *)
               apply (clarsimp simp: isPageFlushLabel_def)+ apply (rule corres_returnOk,clarsimp simp:arch_invocation_relation_def
                translate_arch_invocation_def transform_page_inv_def |
                clarsimp simp: isPageFlushLabel_def)+ done next case (PageTableCap ptr asid) thus ?case supply if_cong[cong] apply (simp add: Decode_D.decode_invocation_def
                     decode_invocation_def arch_decode_invocation_def
               split del: if_split) apply (clarsimp simp: get_page_table_intent_def transform_intent_def
                          map_option_Some_eq2 throw_opt_def cdl_get_pt_mapped_addr_def
                          decode_page_table_invocation_def
                          transform_intent_page_table_map_def
               split del: if_split
               split: label_split_asm list.split_asm) apply (simp add: throw_on_none_def transform_cap_list_def
       get_index_def split_beta alternative_refl
       transform_mapping_def corres_whenE_throwError_split_rhs corres_alternate2
       split: cap.split arch_cap.split option.split cdl_frame_cap_type.splits) apply (clarsimp simp: dc_def[symmetric] liftE_bindE
       gets_the_def bind_assoc transform_mapping_def
       corres_symb_exec_in_gets gets_bind_alternative) apply (rule_tac r'=dc and P'="I" and Q'="\<lambda>rv. I and (\<exists>\<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits))"
               for I in corres_alternative_throw_splitE[OF _ _ returnOk_wp[where x="()"], simplified]) apply (rule corres_from_rdonly, simp_all)[1] apply (wp | simp)+ apply (rule hoare_strengthen_post, rule hoare_post_taut) apply (rename_tac rv s) apply (case_tac rv, auto simp add: in_monad)[1] apply (simp add: corres_whenE_throwError_split_rhs corres_alternate2
                         check_vp_alignment_def unlessE_whenE) apply clarsimp apply (rule corres_symb_exec_r
          [OF _ get_master_pde_invalid_sp get_master_pde_inv],simp_all)[1] apply (clarsimp simp add: corres_whenE_throwError_split_rhs
             corres_alternate2) apply (rule corres_alternate1) apply (rule corres_from_rdonly,simp_all)[1] apply (wp | simp)+ apply (simp add: returnOk_def, wp) apply (clarsimp simp: in_monad select_def arch_invocation_relation_def
          translate_arch_invocation_def transform_page_table_inv_def
          addrFromPPtr_def is_cap_simps cap_object_def
          cdl_lookup_pd_slot_def cap_has_object_def
          neq_Nil_conv cap_aligned_def) apply (simp add: make_arch_duplicate_def transform_pd_slot_ref_def) apply (clarsimp simp add: free_pd_slots_def opt_object_page_directory
                                  obj_at_def invs_valid_idle pd_shifting
                                  object_slots_def transform_page_directory_contents_def
                                  unat_map_def kernel_pde_mask_def
                                  transform_pde_def transform_mapping_def) apply (simp add: pd_shifting_dual ucast_nat_def shiftr_20_less triple_shift_fun
                         le_shiftr linorder_not_le) apply (rule hoare_pre, wp, auto)[1] apply (wp | simp)+ apply (clarsimp simp: is_final_cap'_def
      is_final_cap_def split:list.splits) apply (simp add: liftE_bindE is_final_cap_def corres_symb_exec_in_gets
                     unlessE_whenE corres_whenE_throwError_split_rhs
                     corres_alternate2) apply (rule corres_alternate1, simp add: returnOk_def) apply (clarsimp simp: arch_invocation_relation_def translate_arch_invocation_def get_pt_mapped_addr_def
                          transform_page_table_inv_def is_cap_simps) done next case (PageDirectoryCap pd_ptr asid) thus ?case 
  (* abandon hope, all who enter here *)
   apply (simp add: Decode_D.decode_invocation_def
  decode_invocation_def arch_decode_invocation_def
  get_page_directory_intent_def transform_intent_def
  isPDFlushLabel_def
  split del: if_split) apply (clarsimp simp: get_page_directory_intent_def transform_intent_def
           map_option_Some_eq2 throw_opt_def decode_page_directory_invocation_def
    split: label_split_asm  cdl_intent.splits
           InvocationLabels_H.invocation_label.splits arch_invocation_label.splits) apply (simp_all add: Let_def) apply (all \<open>(intro conjI impI allI)\<close>) apply (all \<open>(simp add: to_select_ret_or_throw whenE_to_select_ret_or_throw split_def
                           del: Collect_const;
            intro corres_initial_bindE_rdonly_select_ret_or_throw
                  corres_select_ret_or_throw[THEN corres_guard_imp];
            (wpsimp simp: if_apply_def2 ex_disj_distrib)?)?\<close>) 

  (* 20-odd subgoals, not going to indent *)

     apply (all \<open>(simp split: option.split)?;
        (intro conjI impI allI corres_initial_bindE_rdonly_select_ret_or_throw
                  corres_select_ret_or_throw[THEN corres_guard_imp])?;
        (wpsimp simp: arch_invocation_relation_def translate_arch_invocation_def
                  transform_page_dir_inv_def flush_type_map_def
                  label_to_flush_type_def
                  ex_disj_distrib)?\<close>) apply ((rule corres_from_rdonly; wpsimp?),
              rule validE_cases_valid, wpsimp,
              simp add: ex_disj_distrib split_sum_ex
                        select_ret_or_throw_def in_monad in_select)+ done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap invoked_cap'; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap invoked_cap' and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). s \<turnstile> x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation invoked_cap invoked_cap_ref excaps intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' invoked_cap' excaps') proof (prove)
goal (2 subgoals):
 1. \<And>s s'. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap invoked_cap'; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap x; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True; (invs and valid_etcbs and valid_cap invoked_cap' and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). s \<turnstile> x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) s'\<rbrakk> \<Longrightarrow> \<forall>x\<in>set (map fst excaps'). cap_aligned x
 2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap invoked_cap'; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap x; \<forall>x\<in>set (map fst excaps'). cap_aligned x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap invoked_cap' and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). s \<turnstile> x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation invoked_cap invoked_cap_ref excaps intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' invoked_cap' excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap invoked_cap'; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap x; \<forall>x\<in>set (map fst excaps'). cap_aligned x\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap invoked_cap' and (\<lambda>s. \<forall>x\<in>set (map fst excaps'). s \<turnstile> x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation invoked_cap invoked_cap_ref excaps intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' invoked_cap' excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap x); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap x; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap x) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap x)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap x) excaps') proof (state)
goal (5 subgoals):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (ASIDPoolCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (ASIDPoolCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (ASIDPoolCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (ASIDPoolCap x1 x2)) excaps')
 2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap ASIDControlCap); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps')
 3. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 4. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 5. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (ASIDPoolCap ap_ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (5 subgoals):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (ASIDPoolCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (ASIDPoolCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (ASIDPoolCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (ASIDPoolCap x1 x2)) excaps')
 2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap ASIDControlCap); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps')
 3. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 4. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 5. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (ASIDPoolCap ap_ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (ASIDPoolCap ap_ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (ASIDPoolCap ap_ptr asid)) excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE asid_pool_intent <- throw_opt undefined (get_asid_pool_intent intent);
liftME InvokeAsidPool (decode_asid_pool_invocation (AsidPoolCap ap_ptr (fst (transform_asid asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') asid_pool_intent)
odE) (if invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps' then let (pd_cap, pd_cap_slot) = excaps' ! 0 in case pd_cap of ArchObjectCap (arch_cap.PageDirectoryCap xa None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of asid));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (ap_ptr \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool ap_ptr;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool asid) free_set;
returnOk $ InvokeASIDPool $ asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr pd_cap_slot
odE | ArchObjectCap (arch_cap.PageDirectoryCap xa (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE (pd_cap, pd_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case pd_cap of cdl_cap.PageDirectoryCap x xa xb \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
offset <- liftE (select {x. x < 2 ^ local.asid_low_bits});
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) pd_cap_ref (ap_ptr, offset))
odE \<sqinter> throw) (if excaps' \<noteq> [] then let (pd_cap, pd_cap_slot) = excaps' ! 0 in case pd_cap of ArchObjectCap (arch_cap.PageDirectoryCap xa None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of asid));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (ap_ptr \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool ap_ptr;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool asid) free_set;
returnOk $ InvokeASIDPool $ asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr pd_cap_slot
odE | ArchObjectCap (arch_cap.PageDirectoryCap xa (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> (\<exists>x51. fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> (\<forall>v. (\<exists>y. v (asid_high_bits_of asid) = Some y) \<longrightarrow> ap_ptr = the (v (asid_high_bits_of asid)) \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap (the (v (asid_high_bits_of asid))) asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (doE (pd_cap, pd_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case pd_cap of cdl_cap.PageDirectoryCap x xa xb \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) pd_cap_ref (the (v (asid_high_bits_of asid)), offset))
od
odE \<sqinter> throw) (do pool <- get_asid_pool (the (v (asid_high_bits_of asid)));
doE y <- whenE (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} = {}) (throwError DeleteFirst);
do offset <- select_ext (\<lambda>_. free_asid_pool_select pool asid) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) (the (v (asid_high_bits_of asid))) (snd (excaps' ! 0))))
od
odE
od)) proof (prove)
goal (1 subgoal):
 1. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od \<sqinter> throw) (do pool <- get_asid_pool ap_ptr;
doE y <- whenE (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} = {}) (throwError DeleteFirst);
do offset <- select_ext (\<lambda>_. free_asid_pool_select pool asid) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr (snd (excaps' ! 0))))
od
odE
od) proof (prove)
goal (3 subgoals):
 1. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?Q'405 x51 v) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od \<sqinter> throw) (do pool <- get_asid_pool ap_ptr;
doE y <- whenE (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} = {}) (throwError DeleteFirst);
do offset <- select_ext (\<lambda>_. free_asid_pool_select pool asid) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr (snd (excaps' ! 0))))
od
odE
od)
 2. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 3. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (6 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?Q'409 x51 v pool) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od \<sqinter> throw) (doE y <- whenE (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} = {}) (throwError DeleteFirst);
do offset <- select_ext (\<lambda>_. free_asid_pool_select pool asid) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr (snd (excaps' ! 0))))
od
odE)
 2. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 3. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (6 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?Q'409 x51 v pool) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od \<sqinter> throw) (do offset <- select_ext (\<lambda>_. free_asid_pool_select pool asid) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr (snd (excaps' ! 0))))
od)
 2. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 3. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (6 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?Q'409 x51 v pool) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od) (do offset <- select_ext (\<lambda>_. free_asid_pool_select pool asid) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0});
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) offset + asid) ap_ptr (snd (excaps' ! 0))))
od)
 2. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 3. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (6 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?Q'409 x51 v pool) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od) (do x <- get;
y <- assert (free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0);
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0))))
od)
 2. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 3. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?Q'419 x51 v pool rv) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od) (do y <- assert (free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0);
returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0))))
od)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>?Q'419 x51 v pool\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (do offset <- select {x. x < 2 ^ local.asid_low_bits};
returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), offset) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, offset))
od) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> unat (free_asid_pool_select pool asid) \<in> {x. x < 2 ^ local.asid_low_bits}
 2. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid)))) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> unat (free_asid_pool_select pool asid) < 2 ^ local.asid_low_bits
 2. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid)))) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> unat (free_asid_pool_select pool asid) < 2 ^ local.asid_low_bits
 2. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid)))) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> unat (free_asid_pool_select pool asid) \<le> 2 ^ local.asid_low_bits - Suc 0
 2. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid)))) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> free_asid_pool_select pool asid \<le> word_of_nat (2 ^ local.asid_low_bits - Suc 0)
 2. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid)))) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool)) (?Q405 x51 v) (?P'423 x51 v pool rv) (returnOk (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid)))) (returnOk (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0)))))
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> ?P'423 x51 v pool r s\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> ?Q405 x51 v s
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool rv s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True; is_aligned asid local.asid_low_bits\<rbrakk> \<Longrightarrow> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidPool) (cdl_asid_pool_invocation.Assign (fst (transform_asid asid), unat (free_asid_pool_select pool asid)) (transform_cslot_ptr (snd (excaps' ! 0))) (ap_ptr, unat (free_asid_pool_select pool asid))) (InvokeASIDPool (asid_pool_invocation.Assign (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) ap_ptr (snd (excaps' ! 0))))
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 7) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid >> local.asid_low_bits) = UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits) \<longrightarrow> UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 7) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid >> local.asid_low_bits) = UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid >> local.asid_low_bits = asid >> local.asid_low_bits
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (11 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) < 2 ^ local.asid_low_bits
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 6. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 10. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> 2 ^ local.asid_low_bits \<noteq> 0
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) \<le> 2 ^ local.asid_low_bits - 1
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 6. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 7. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) \<le> 2 ^ local.asid_low_bits - 1
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 6. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 10. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> 2 ^ local.asid_low_bits - 1 < 2 ^ size (free_asid_pool_select pool asid)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> size (free_asid_pool_select pool asid) < size (2 ^ local.asid_low_bits - 1)
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> free_asid_pool_select pool asid \<le> UCAST(32 \<rightarrow> 10) (2 ^ local.asid_low_bits - 1)
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 6. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 7. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 8. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 10. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> size (free_asid_pool_select pool asid) < size (2 ^ local.asid_low_bits - 1)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> free_asid_pool_select pool asid \<le> UCAST(32 \<rightarrow> 10) (2 ^ local.asid_low_bits - 1)
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 6. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 7. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> free_asid_pool_select pool asid \<le> UCAST(32 \<rightarrow> 10) (2 ^ local.asid_low_bits - 1)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 6. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 10. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_down UCAST(32 \<rightarrow> 10)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> free_asid_pool_select pool asid \<le> UCAST(32 \<rightarrow> 10) (2 ^ local.asid_low_bits) - UCAST(32 \<rightarrow> 10) 1
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 6. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 7. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 10. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> free_asid_pool_select pool asid \<le> UCAST(32 \<rightarrow> 10) (2 ^ local.asid_low_bits) - UCAST(32 \<rightarrow> 10) 1
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 5. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 6. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 9. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 10. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> is_aligned asid local.asid_low_bits
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 4. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 5. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 8. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 10. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> asid >> local.asid_low_bits = asid >> local.asid_low_bits
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) (UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid) \<noteq> free_asid_pool_select pool asid\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0; UCAST(32 \<rightarrow> 10) asid \<noteq> 0\<rbrakk> \<Longrightarrow> \<exists>y. pool (free_asid_pool_select pool asid) = Some y
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 10) asid = 0
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (9 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> UCAST(10 \<rightarrow> 32) (UCAST(32 \<rightarrow> 10) asid) = UCAST(10 \<rightarrow> 32) 0
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> LENGTH(10) \<le> LENGTH(32)
 3. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 4. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 7. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 9. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (8 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (unat (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (UCAST(32 \<rightarrow> 7) (asid >> local.asid_low_bits)) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}; is_aligned asid local.asid_low_bits; UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0\<rbrakk> \<Longrightarrow> LENGTH(10) \<le> LENGTH(32)
 2. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 3. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 5. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 6. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 8. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal (7 subgoals):
 1. \<And>x51 v pool. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>?Q'409 x51 v pool\<rbrace> get \<lbrace>\<lambda>r s. free_asid_pool_select pool asid \<notin> dom pool \<and> UCAST(10 \<rightarrow> 32) (free_asid_pool_select pool asid) + asid \<noteq> 0 \<longrightarrow> is_aligned asid local.asid_low_bits\<rbrace>
 2. \<And>x51 v pool cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + asid \<noteq> 0} \<noteq> {}\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr\<rbrakk> \<Longrightarrow> \<lbrace>?Q'405 x51 v\<rbrace> get_asid_pool ap_ptr \<lbrace>?Q'409 x51 v\<rbrace>
 4. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ?Q'405 x51 v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> get_asid_pool ap_ptr \<lbrace>\<lambda>r. (=) s\<rbrace>
 5. \<And>x51 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; False\<rbrakk> \<Longrightarrow> no_fail (?Q'405 x51 v) (get_asid_pool ap_ptr)
 6. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; True\<rbrakk> \<Longrightarrow> True
 7. \<And>x51 v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidPoolCap ap_ptr (fst (transform_asid asid)); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (ASIDPoolCap ap_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 None); excaps' \<noteq> []; v (asid_high_bits_of asid) = Some ap_ptr; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'405 x51 v s proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (ASIDPoolCap ap_ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (ASIDPoolCap ap_ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (ASIDPoolCap ap_ptr asid)) excaps')

goal (4 subgoals):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap ASIDControlCap); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps')
 2. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 3. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 4. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
goal (4 subgoals):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap ASIDControlCap); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps')
 2. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 3. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 4. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap ASIDControlCap)
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap ASIDControlCap
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (4 subgoals):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap ASIDControlCap); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps')
 2. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 3. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 4. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap ASIDControlCap)
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap ASIDControlCap
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE asid_control_intent <- throw_opt undefined (get_asid_control_intent intent);
liftME InvokeAsidControl (decode_asid_control_invocation AsidControlCap (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') asid_control_intent)
odE) (if invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length args' \<and> 1 < length excaps' then let index = args' ! 0; depth = args' ! 1; (untyped, parent_slot) = excaps' ! 0; root = fst (excaps' ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of cap.UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | cap.UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE CSpace_A.ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ asid_control_invocation.MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE base <- liftE (select {x. x < 2 ^ local.asid_high_bits});
(untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE \<sqinter> throw) (if Suc 0 < length excaps' then let index = (x21 # x21a # x22a) ! 0; depth = (x21 # x21a # x22a) ! 1; (untyped, parent_slot) = excaps' ! 0; root = fst (excaps' ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of cap.UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | cap.UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE CSpace_A.ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
CSpaceAcc_A.ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ asid_control_invocation.MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a)\<rbrakk> \<Longrightarrow> (fst (excaps' ! 0) = cap.NullCap \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> (\<forall>x21b x22 x23. (\<exists>x24. fst (excaps' ! 0) = cap.UntypedCap x21b x22 x23 x24) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case x21b of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (x22, x23);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od))) \<and> ((\<exists>x31 x32 x33. fst (excaps' ! 0) = cap.EndpointCap x31 x32 x33) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x41 x42 x43. fst (excaps' ! 0) = cap.NotificationCap x41 x42 x43) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x51 x52 x53. fst (excaps' ! 0) = cap.ReplyCap x51 x52 x53) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x61 x62 x63. fst (excaps' ! 0) = cap.CNodeCap x61 x62 x63) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x7. fst (excaps' ! 0) = ThreadCap x7) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> (fst (excaps' ! 0) = cap.DomainCap \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> (fst (excaps' ! 0) = IRQControlCap \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x10. fst (excaps' ! 0) = IRQHandlerCap x10) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x111 x112 x113. fst (excaps' ! 0) = Zombie x111 x112 x113) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x12. fst (excaps' ! 0) = ArchObjectCap x12) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE (untyped_cap, untyped_cap_ref) <- throw_on_none (get_index (transform_cap_list excaps') 0);
y <- case untyped_cap of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children untyped_cap_ref;
(cspace_cap, uu_) <- throw_on_none (get_index (transform_cap_list excaps') (Suc 0));
target_slot <- CSpace_D.lookup_slot_for_cnode_op cspace_cap x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range untyped_cap {}) untyped_cap_ref (cap_objects untyped_cap) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []\<rbrakk> \<Longrightarrow> (fst (excaps' ! 0) = cap.NullCap \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> (\<forall>x21b x22 x23. (\<exists>x24. fst (excaps' ! 0) = cap.UntypedCap x21b x22 x23 x24) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case x21b of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (x22, x23);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od))) \<and> ((\<exists>x31 x32 x33. fst (excaps' ! 0) = cap.EndpointCap x31 x32 x33) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x41 x42 x43. fst (excaps' ! 0) = cap.NotificationCap x41 x42 x43) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x51 x52 x53. fst (excaps' ! 0) = cap.ReplyCap x51 x52 x53) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x61 x62 x63. fst (excaps' ! 0) = cap.CNodeCap x61 x62 x63) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x7. fst (excaps' ! 0) = ThreadCap x7) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> (fst (excaps' ! 0) = cap.DomainCap \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> (fst (excaps' ! 0) = IRQControlCap \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x10. fst (excaps' ! 0) = IRQHandlerCap x10) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x111 x112 x113. fst (excaps' ! 0) = Zombie x111 x112 x113) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) \<and> ((\<exists>x12. fst (excaps' ! 0) = ArchObjectCap x12) \<longrightarrow> Suc 0 < length excaps' \<longrightarrow> (\<forall>v. - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od))) proof (prove)
goal (12 subgoals):
 1. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = cap.NullCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a x21b x22 x23 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap x21b x22 x23 x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case x21b of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (x22, x23);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od)
 3. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x31 x32 x33. fst (excaps' ! 0) = cap.EndpointCap x31 x32 x33; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 4. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x41 x42 x43. fst (excaps' ! 0) = cap.NotificationCap x41 x42 x43; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 5. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x51 x52 x53. fst (excaps' ! 0) = cap.ReplyCap x51 x52 x53; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 6. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x61 x62 x63. fst (excaps' ! 0) = cap.CNodeCap x61 x62 x63; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 7. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x7. fst (excaps' ! 0) = ThreadCap x7; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 8. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = cap.DomainCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 9. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = IRQControlCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 10. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x10. fst (excaps' ! 0) = IRQHandlerCap x10; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a x21b x22 x23 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap x21b x22 x23 x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case x21b of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (x22, x23);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od)
 2. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x31 x32 x33. fst (excaps' ! 0) = cap.EndpointCap x31 x32 x33; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 3. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x41 x42 x43. fst (excaps' ! 0) = cap.NotificationCap x41 x42 x43; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 4. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x51 x52 x53. fst (excaps' ! 0) = cap.ReplyCap x51 x52 x53; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 5. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x61 x62 x63. fst (excaps' ! 0) = cap.CNodeCap x61 x62 x63; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 6. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x7. fst (excaps' ! 0) = ThreadCap x7; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 7. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = cap.DomainCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 8. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = IRQControlCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 9. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x10. fst (excaps' ! 0) = IRQHandlerCap x10; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 10. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x111 x112 x113. fst (excaps' ! 0) = Zombie x111 x112 x113; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x31 x32 x33. fst (excaps' ! 0) = cap.EndpointCap x31 x32 x33; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x41 x42 x43. fst (excaps' ! 0) = cap.NotificationCap x41 x42 x43; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 3. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x51 x52 x53. fst (excaps' ! 0) = cap.ReplyCap x51 x52 x53; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 4. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x61 x62 x63. fst (excaps' ! 0) = cap.CNodeCap x61 x62 x63; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 5. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x7. fst (excaps' ! 0) = ThreadCap x7; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 6. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = cap.DomainCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 7. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; fst (excaps' ! 0) = IRQControlCap; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
throw
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 8. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x10. fst (excaps' ! 0) = IRQHandlerCap x10; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 9. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x111 x112 x113. fst (excaps' ! 0) = Zombie x111 x112 x113; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 10. \<And>x21 x21a x22a v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x12. fst (excaps' ! 0) = ArchObjectCap x12; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
A total of 11 subgoals... proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a x21b x22 x23 v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap x21b x22 x23 x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case x21b of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (x22, x23);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od)
 2. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) throw (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q737 x21 x21a x22a dev ptr sz v) (?Q'737 x21 x21a x22a dev ptr sz v) throw (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; True\<rbrakk> \<Longrightarrow> ?Q737 x21 x21a x22a dev ptr sz v s
 3. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'737 x21 x21a x22a dev ptr sz v s
 4. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v free. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q737 x21 x21a x22a dev ptr sz v) (?Q'741 x21 x21a x22a dev ptr sz v free) throw (throwError (InvalidCapability (Suc 0)))
 2. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'737 x21 x21a x22a dev ptr sz v\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>?Q'741 x21 x21a x22a dev ptr sz v\<rbrace>
 3. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; ?Q'737 x21 x21a x22a dev ptr sz v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; False\<rbrakk> \<Longrightarrow> no_fail (?Q'737 x21 x21a x22a dev ptr sz v) (select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}))
 5. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; True\<rbrakk> \<Longrightarrow> ?Q737 x21 x21a x22a dev ptr sz v s
 6. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'737 x21 x21a x22a dev ptr sz v s
 7. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev\<rbrakk> \<Longrightarrow> \<lbrace>?Q'737 x21 x21a x22a dev ptr sz v\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>\<lambda>free _. True\<rbrace>
 2. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; ?Q'737 x21 x21a x22a dev ptr sz v s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; False\<rbrakk> \<Longrightarrow> no_fail (?Q'737 x21 x21a x22a dev ptr sz v) (select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}))
 4. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; True\<rbrakk> \<Longrightarrow> True
 5. \<And>x21 x21a x22a dev ptr sz v s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap True ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; dev; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'737 x21 x21a x22a dev ptr sz v s
 6. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr sz v. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; \<exists>x24. fst (excaps' ! 0) = cap.UntypedCap dev ptr sz x24; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- case transform_cap (fst (excaps' ! 0)) of cdl_cap.UntypedCap x s xa \<Rightarrow> returnOk () | _ \<Rightarrow> throw;
y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (set_available_range (transform_cap (fst (excaps' ! 0))) {}) (transform_cslot_ptr (snd (excaps' ! 0))) (cap_objects (transform_cap (fst (excaps' ! 0)))) target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE (p, n) <- case dev of True \<Rightarrow> throwError $ InvalidCapability 1 | False \<Rightarrow> returnOk (ptr, sz);
frame <- if n = pageBits then doE CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> (sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od)) \<and> (sz \<noteq> pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ sz - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ sz - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz \<noteq> pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ sz - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ sz - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ sz - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ sz - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) throw (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q771 x21 x21a x22a dev ptr sz v x24) (?Q'771 x21 x21a x22a dev ptr sz v x24) throw (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
throwError (InvalidCapability (Suc 0))
od)
 2. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; True\<rbrakk> \<Longrightarrow> ?Q771 x21 x21a x22a dev ptr sz v x24 s
 3. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'771 x21 x21a x22a dev ptr sz v x24 s
 4. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v x24 free. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q771 x21 x21a x22a dev ptr sz v x24) (?Q'775 x21 x21a x22a dev ptr sz v x24 free) throw (throwError (InvalidCapability (Suc 0)))
 2. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'771 x21 x21a x22a dev ptr sz v x24\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>?Q'775 x21 x21a x22a dev ptr sz v x24\<rbrace>
 3. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; ?Q'771 x21 x21a x22a dev ptr sz v x24 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>\<lambda>r. (=) s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; False\<rbrakk> \<Longrightarrow> no_fail (?Q'771 x21 x21a x22a dev ptr sz v x24) (select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}))
 5. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; True\<rbrakk> \<Longrightarrow> ?Q771 x21 x21a x22a dev ptr sz v x24 s
 6. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'771 x21 x21a x22a dev ptr sz v x24 s
 7. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits\<rbrakk> \<Longrightarrow> \<lbrace>?Q'771 x21 x21a x22a dev ptr sz v x24\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>\<lambda>free _. True\<rbrace>
 2. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; ?Q'771 x21 x21a x22a dev ptr sz v x24 s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}) \<lbrace>\<lambda>r. (=) s\<rbrace>
 3. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; False\<rbrakk> \<Longrightarrow> no_fail (?Q'771 x21 x21a x22a dev ptr sz v x24) (select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}))
 4. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; True\<rbrakk> \<Longrightarrow> True
 5. \<And>x21 x21a x22a dev ptr sz v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24; sz \<noteq> pageBits; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'771 x21 x21a x22a dev ptr sz v x24 s
 6. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr sz v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr sz x24\<rbrakk> \<Longrightarrow> sz = pageBits \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a dev ptr v x24) (?Q'794 x21 x21a x22a dev ptr v x24) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od \<sqinter> throw) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od)
 2. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 3. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a dev ptr v x24) (?Q'794 x21 x21a x22a dev ptr v x24) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od) (do free <- select_ext (\<lambda>_. free_asid_select v) (- dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE
od)
 2. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 3. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?Q'794 x21 x21a x22a False ptr v x24) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od) (do x <- get;
y <- assert (free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1);
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE
od)
 2. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 3. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?Q'802 x21 x21a x22a dev ptr v x24 rv) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od) (do y <- assert (free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1);
doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE
od)
 2. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>?Q'802 x21 x21a x22a dev ptr v x24\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (do base <- select {x. x < 2 ^ local.asid_high_bits};
doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot base)
odE
od) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 2. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> unat (free_asid_select v) \<in> {x. x < 2 ^ local.asid_high_bits}
 2. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 3. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 6. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> unat (free_asid_select v) < 2 ^ local.asid_high_bits
 2. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 3. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 6. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> unat (free_asid_select v) < 2 ^ local.asid_high_bits
 2. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 3. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 6. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> unat (free_asid_select v) \<le> 2 ^ local.asid_high_bits - Suc 0
 2. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 3. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 6. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> free_asid_select v \<le> word_of_nat (2 ^ local.asid_high_bits - Suc 0)
 2. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 3. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 6. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a dev ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE frame <- doE y <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
returnOk ptr
odE;
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool frame dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 2. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?Q794 x21 x21a x22a False ptr v x24) (?P'812 x21 x21a x22a False ptr v x24 rv) (doE y <- CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0)));
target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE x <- CSpace_A.ensure_no_children (snd (excaps' ! 0));
dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool ptr dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 2. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ?P'812 x21 x21a x22a dev ptr v x24 r s\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ?Q794 x21 x21a x22a dev ptr v x24 s
 5. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?R828 x21 x21a x22a dev ptr v x24 rv rva) (?R'828 x21 x21a x22a dev ptr v x24 rv rv') (doE target_slot <- CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a);
y <- CSpace_D.ensure_empty target_slot;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} target_slot (unat (free_asid_select v)))
odE) (doE dest_slot <- CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a);
y <- CSpaceAcc_A.ensure_empty dest_slot;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool ptr dest_slot (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 2. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>?R828 x21 x21a x22a dev ptr v x24 rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>?R'828 x21 x21a x22a dev ptr v x24 rv\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
 7. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'841 x21 x21a x22a dev ptr v x24 rv rva rv') (?P842 x21 x21a x22a dev ptr v x24 rv rva) (?P'844 x21 x21a x22a dev ptr v x24 rv rv') (CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a)) (CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a))
 2. \<And>x21 x21a x22a dev ptr v x24 rv rva rv' rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'; ?r'841 x21 x21a x22a dev ptr v x24 rv rva rv' rvb rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?R841 x21 x21a x22a dev ptr v x24 rv rva rv' rvb) (?R'841 x21 x21a x22a dev ptr v x24 rv rva rv' rv'a) (doE y <- CSpace_D.ensure_empty rvb;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} rvb (unat (free_asid_select v)))
odE) (doE y <- CSpaceAcc_A.ensure_empty rv'a;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool ptr rv'a (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 3. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>?R841 x21 x21a x22a dev ptr v x24 rv rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>?R'841 x21 x21a x22a dev ptr v x24 rv rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. ?P842 x21 x21a x22a dev ptr v x24 rv rva and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. ?P'844 x21 x21a x22a dev ptr v x24 rv rv' and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rva rv' rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'; rvb = transform_cslot_ptr rv'a\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> InvokeAsidControl)) (?R841 x21 x21a x22a dev ptr v x24 rv rva rv' rvb) (?R'841 x21 x21a x22a dev ptr v x24 rv rva rv' rv'a) (doE y <- CSpace_D.ensure_empty rvb;
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} rvb (unat (free_asid_select v)))
odE) (doE y <- CSpaceAcc_A.ensure_empty rv'a;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool ptr rv'a (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 2. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>?R841 x21 x21a x22a dev ptr v x24 rv rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>?R'841 x21 x21a x22a dev ptr v x24 rv rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
 9. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (9 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (InvokeAsidControl a))) (?R841 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)) (?R'841 x21 x21a x22a False ptr v x24 rv () () rv'a) (doE y <- CSpace_D.ensure_empty (transform_cslot_ptr rv'a);
returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} (transform_cslot_ptr rv'a) (unat (free_asid_select v)))
odE) (doE y <- CSpaceAcc_A.ensure_empty rv'a;
returnOk (InvokeASIDControl (asid_control_invocation.MakePool ptr rv'a (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
odE)
 2. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>?R841 x21 x21a x22a dev ptr v x24 rv rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>?R'841 x21 x21a x22a dev ptr v x24 rv rva rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
 9. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a y ya. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; dc y ya\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (InvokeAsidControl a))) (?R867 x21 x21a x22a dev ptr v x24 rv rvb rv'a y) (?R'867 x21 x21a x22a dev ptr v x24 rv rvb rv'a ya) (returnOk (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} (transform_cslot_ptr rv'a) (unat (free_asid_select v)))) (returnOk (InvokeASIDControl (asid_control_invocation.MakePool ptr rv'a (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits))))
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>?R867 x21 x21a x22a dev ptr v x24 rv rvb rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>?R'867 x21 x21a x22a dev ptr v x24 rv rvb rv'a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a y ya s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; dc y ya; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; True; True\<rbrakk> \<Longrightarrow> arch_invocation_relation (InvokeAsidControl (cdl_asid_control_invocation.MakePool (cdl_cap.UntypedCap False {ptr..ptr + 2 ^ pageBits - 1} {}) (transform_cslot_ptr (snd (excaps' ! 0))) {ptr..ptr + 2 ^ pageBits - 1} (transform_cslot_ptr rv'a) (unat (free_asid_select v)))) (InvokeASIDControl (asid_control_invocation.MakePool ptr rv'a (snd (excaps' ! 0)) (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)))
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rvb rv'a s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s', cdl_cdt = transform_cdt s', cdl_current_thread = transform_current_thread s', cdl_irq_node = interrupt_irq_node s', cdl_asid_table = transform_asid_table s', cdl_current_domain = cur_domain s'\<rparr> = s\<rbrakk> \<Longrightarrow> fst (transform_asid (UCAST(7 \<rightarrow> 32) (free_asid_select v) << local.asid_low_bits)) = unat (free_asid_select v)
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rvb rv'a s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s', cdl_cdt = transform_cdt s', cdl_current_thread = transform_current_thread s', cdl_irq_node = interrupt_irq_node s', cdl_asid_table = transform_asid_table s', cdl_current_domain = cur_domain s'\<rparr> = s\<rbrakk> \<Longrightarrow> asid_high_bits_of (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) = free_asid_select v
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rvb rv'a s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; \<lparr>cdl_arch = ARM11, cdl_objects = transform_objects s', cdl_cdt = transform_cdt s', cdl_current_thread = transform_current_thread s', cdl_irq_node = interrupt_irq_node s', cdl_asid_table = transform_asid_table s', cdl_current_domain = cur_domain s'\<rparr> = s\<rbrakk> \<Longrightarrow> asid_high_bits_of (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) = free_asid_select v
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba)\<rbrakk> \<Longrightarrow> asid_high_bits_of (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) = free_asid_select v
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba); unat (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) mod 1024 = 0\<rbrakk> \<Longrightarrow> asid_high_bits_of (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) = free_asid_select v
 2. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba)\<rbrakk> \<Longrightarrow> unat (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) mod 1024 = 0
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba)\<rbrakk> \<Longrightarrow> unat (UCAST(7 \<rightarrow> 32) (free_asid_select v) << 10) mod 1024 = 0
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba)\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (free_asid_select v) < 0x400000
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba)\<rbrakk> \<Longrightarrow> LENGTH(7) < LENGTH(32)
 2. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba); UCAST(7 \<rightarrow> 32) (free_asid_select v) < 2 ^ LENGTH(7)\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (free_asid_select v) < 0x400000
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba); UCAST(7 \<rightarrow> 32) (free_asid_select v) < 2 ^ LENGTH(7)\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (free_asid_select v) < 0x400000
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba); UCAST(7 \<rightarrow> 32) (free_asid_select v) < 2 ^ LENGTH(7)\<rbrakk> \<Longrightarrow> UCAST(7 \<rightarrow> 32) (free_asid_select v) < ?y891 x21 x21a x22a dev ptr v x24 a b aa ba
 2. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba); UCAST(7 \<rightarrow> 32) (free_asid_select v) < 2 ^ LENGTH(7)\<rbrakk> \<Longrightarrow> ?y891 x21 x21a x22a dev ptr v x24 a b aa ba < 0x400000
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 a b aa ba. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; (a, b) = transform_cslot_ptr (aa, ba); UCAST(7 \<rightarrow> 32) (free_asid_select v) < 2 ^ LENGTH(7)\<rbrakk> \<Longrightarrow> 0x80 < 0x400000
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q875 x21 x21a x22a False ptr v x24 rv () () (transform_cslot_ptr rv'a)\<rbrace> CSpace_D.ensure_empty (transform_cslot_ptr rv'a) \<lbrace>\<lambda>y _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x22a dev ptr v x24 rv rvb rv'a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; rvb = transform_cslot_ptr rv'a; free_asid_select v \<notin> dom v; free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'873 x21 x21a x22a False ptr v x24 rv () () rv'a\<rbrace> CSpaceAcc_A.ensure_empty rv'a \<lbrace>\<lambda>ya _. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace> CSpace_D.lookup_slot_for_cnode_op (transform_cap (fst (excaps' ! Suc 0))) x21 (unat x21a) \<lbrace>\<lambda>a. (\<lambda>_. True) and ?Q875 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a dev ptr v x24 rv rva rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1; rva = rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace> CSpace_A.lookup_slot_for_cnode_op False (fst (excaps' ! Suc 0)) (to_bl x21) (unat x21a) \<lbrace>\<lambda>a. valid_idle and not_idle_thread (fst a) and valid_etcbs and ?Q'873 x21 x21a x22a dev ptr v x24 rv rva rv' a\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q836 x21 x21a x22a False ptr v x24\<rbrace> CSpace_D.ensure_no_children (transform_cslot_ptr (snd (excaps' ! 0))) \<lbrace>\<lambda>rva. (\<lambda>_. True) and ?Q843 x21 x21a x22a dev ptr v x24 rv rva\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a dev ptr v x24 rv. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1\<rbrakk> \<Longrightarrow> \<lbrace>?Q'834 x21 x21a x22a False ptr v x24 rv\<rbrace> CSpace_A.ensure_no_children (snd (excaps' ! 0)) \<lbrace>\<lambda>rv'. valid_objs and valid_cap (fst (excaps' ! Suc 0)) and valid_global_refs and valid_idle and valid_etcbs and ?Q'845 x21 x21a x22a dev ptr v x24 rv rv'\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x22a dev ptr v x24. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>?Q'794 x21 x21a x22a False ptr v x24\<rbrace> get \<lbrace>\<lambda>r s. free_asid_select v \<notin> dom v \<and> free_asid_select v \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> ((\<lambda>s. mdb_cte_at (swp (cte_wp_at ((\<noteq>) cap.NullCap)) s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s) and ?Q'834 x21 x21a x22a dev ptr v x24 r) s\<rbrace>
 8. \<And>x21 x21a x22a dev ptr v x24 cs. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> get \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 9. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; True\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q836 x21 x21a x22a dev ptr v x24) s
 10. \<And>x21 x21a x22a dev ptr v x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom v \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. asid_table s = v)) s\<rbrakk> \<Longrightarrow> ?Q'794 x21 x21a x22a dev ptr v x24 s proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); excaps' \<noteq> []; Suc 0 < length excaps'; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; invs s \<and> valid_etcbs s \<and> s \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)\<rbrakk> \<Longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> mdb_cte_at (\<lambda>a. cte_wp_at ((\<noteq>) cap.NullCap) a s) (cdt s) \<and> cte_wp_at (\<lambda>_. True) (snd (excaps' ! 0)) s \<and> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s proof (prove)
goal (1 subgoal):
 1. \<And>x21 x21a x22a dev ptr x24 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = AsidControlCap; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap ASIDControlCap; \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; args' = x21 # x21a # x22a; intent = AsidControlIntent (AsidControlMakePoolIntent x21 x21a); \<exists>a aa b ys. excaps' = (a, aa, b) # ys; Suc 0 < length excaps'; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> dev; fst (excaps' ! 0) = cap.UntypedCap False ptr pageBits x24; invs s \<and> valid_etcbs s \<and> s \<turnstile> ArchObjectCap ASIDControlCap \<and> (\<forall>x\<in>set excaps'. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. caps_of_state s (snd x) = Some (fst x))\<rbrakk> \<Longrightarrow> free_asid_select (asid_table s) \<notin> dom (asid_table s) \<and> free_asid_select (asid_table s) \<le> 2 ^ local.asid_high_bits - 1 \<longrightarrow> valid_objs s \<and> valid_global_refs s \<and> valid_idle s \<and> valid_objs s \<and> valid_idle s proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap ASIDControlCap) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap ASIDControlCap)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap ASIDControlCap) excaps')

goal (3 subgoals):
 1. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 2. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 3. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
goal (3 subgoals):
 1. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 2. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 3. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (PageCap dev base rights pgsz asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (3 subgoals):
 1. \<And>x1 x2 x3 x4 x5. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap x1 x2 x3 x4 x5); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap x1 x2 x3 x4 x5))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap x1 x2 x3 x4 x5)) excaps')
 2. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 3. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (PageCap dev base rights pgsz asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap dev base rights pgsz asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap dev base rights pgsz asid)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (PageCap dev base rights pgsz asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap dev base rights pgsz asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap dev base rights pgsz asid)) excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE page_intent <- throw_opt undefined (get_page_intent intent);
liftME cdl_invocation.InvokePage (decode_page_invocation (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') page_intent)
odE) (if invocation_type label' = ArchInvocationLabel ARMPageMap then if 2 < length args' \<and> excaps' \<noteq> [] then let vaddr = args' ! 0 in doE (pd, asida) <- case fst (excaps' ! 0) of ArchObjectCap (arch_cap.PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- case asid of None \<Rightarrow> whenE (kernel_base \<le> vaddr + 2 ^ pageBitsForSize pgsz - 1) (throwError (InvalidArgument 0)) | Some (asid', vaddr') \<Rightarrow> doE y <- whenE (asid' \<noteq> asida) (throwError (InvalidCapability (Suc 0)));
whenE (vaddr' \<noteq> vaddr) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid asida);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr base) vaddr pgsz (mask_vm_rights rights (data_to_rights (args' ! Suc 0))) (attribs_from_word (args' ! 2)) pd;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap asida (ArchObjectCap (PageCap dev base rights pgsz (Some (asida, vaddr)))) invoked_cap_ref' entries))
odE else throwError TruncatedMessage else if invocation_type label' = ArchInvocationLabel ARMPageUnmap then returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')) else if isPageFlushLabel (invocation_type label') then if Suc 0 < length args' then let start = args' ! 0; end = args' ! Suc 0 in doE (asid, vaddr) <- case asid of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (invocation_type label')) (start + vaddr) (end + vaddr - 1) (addrFromPPtr base + start) pd asid))
odE else throwError TruncatedMessage else if invocation_type label' = ArchInvocationLabel ARMPageGetAddress then returnOk (arch_invocation.InvokePage (PageGetAddr base)) else throwError IllegalOperation) proof (prove)
goal (45 subgoals):
 1. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel UntypedRetype; transform_intent_untyped_retype args' = Some z; intent = UntypedIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel UntypedRetype) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel UntypedRetype)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBReadRegisters; transform_intent_tcb_read_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBReadRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBReadRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBWriteRegisters; transform_intent_tcb_write_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBWriteRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBWriteRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBCopyRegisters; transform_intent_tcb_copy_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBCopyRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBCopyRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBConfigure; transform_intent_tcb_configure args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBConfigure) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBConfigure)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetPriority; transform_intent_tcb_set_priority args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetPriority) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetPriority)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetMCPriority; transform_intent_tcb_set_mcpriority args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetMCPriority) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetMCPriority)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetSchedParams; transform_intent_tcb_set_sched_params args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetSchedParams) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetSchedParams)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetIPCBuffer; transform_intent_tcb_set_ipc_buffer args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetIPCBuffer) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetIPCBuffer)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetSpace; transform_intent_tcb_set_space args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetSpace) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetSpace)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 45 subgoals... proof (prove)
goal (45 subgoals):
 1. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel UntypedRetype; transform_intent_untyped_retype args' = Some z; intent = UntypedIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel UntypedRetype) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel UntypedRetype)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBReadRegisters; transform_intent_tcb_read_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBReadRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBReadRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBWriteRegisters; transform_intent_tcb_write_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBWriteRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBWriteRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBCopyRegisters; transform_intent_tcb_copy_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBCopyRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBCopyRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBConfigure; transform_intent_tcb_configure args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBConfigure) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBConfigure)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetPriority; transform_intent_tcb_set_priority args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetPriority) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetPriority)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetMCPriority; transform_intent_tcb_set_mcpriority args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetMCPriority) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetMCPriority)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetSchedParams; transform_intent_tcb_set_sched_params args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetSchedParams) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetSchedParams)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetIPCBuffer; transform_intent_tcb_set_ipc_buffer args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetIPCBuffer) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetIPCBuffer)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetSpace; transform_intent_tcb_set_space args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetSpace) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetSpace)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 45 subgoals... proof (prove)
goal (45 subgoals):
 1. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel UntypedRetype; transform_intent_untyped_retype args' = Some z; intent = UntypedIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (GenInvocationLabel UntypedRetype)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel UntypedRetype)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBReadRegisters; transform_intent_tcb_read_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBReadRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBReadRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBWriteRegisters; transform_intent_tcb_write_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBWriteRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBWriteRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBCopyRegisters; transform_intent_tcb_copy_registers args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBCopyRegisters) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBCopyRegisters)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBConfigure; transform_intent_tcb_configure args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBConfigure) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBConfigure)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetPriority; transform_intent_tcb_set_priority args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetPriority) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetPriority)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetMCPriority; transform_intent_tcb_set_mcpriority args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetMCPriority) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetMCPriority)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetSchedParams; transform_intent_tcb_set_sched_params args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetSchedParams) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetSchedParams)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetIPCBuffer; transform_intent_tcb_set_ipc_buffer args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetIPCBuffer) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetIPCBuffer)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = GenInvocationLabel TCBSetSpace; transform_intent_tcb_set_space args' = Some z; intent = TcbIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (GenInvocationLabel TCBSetSpace) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (GenInvocationLabel TCBSetSpace)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 45 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b)\<rbrakk> \<Longrightarrow> \<forall>x51 x2. (asid = None \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1 \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None)) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b)))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b)\<rbrakk> \<Longrightarrow> \<forall>x51 x2. (asid = None \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1 \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None)) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b)))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b)\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1 \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b)\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> (\<exists>a aa b ys. excaps' = (a, aa, b) # ys) \<longrightarrow> \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1 \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> (\<forall>xa\<in>set excaps'. x \<turnstile> fst xa) \<and> (\<forall>xa\<in>set excaps'. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> (\<forall>xa\<in>set excaps'. x \<turnstile> fst xa) \<and> (\<forall>xa\<in>set excaps'. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> (\<exists>a aa b ys. excaps' = (a, aa, b) # ys) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> (\<forall>xa\<in>set excaps'. x \<turnstile> fst xa) \<and> (\<forall>xa\<in>set excaps'. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> (\<forall>xa\<in>set excaps'. x \<turnstile> fst xa) \<and> (\<forall>xa\<in>set excaps'. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE) proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 11 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>a. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (returnOk () \<sqinter> throw) (lookup_error_on_failure False (find_pd_for_asid x2))
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 15 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk () \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys s s' rv sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = s; True\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = sa; True\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) sa)) \<and> (dc \<oplus> dc) rv' rv
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> x' = x51 \<longrightarrow> is_aligned x21 (pageBitsForSize pgsz) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1443 x21 x21a x21b x22b x51 x2 aa b ys) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<sqinter> throw) (create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51)
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ?r'1443 x21 x21a x21b x22b x51 x2 aa b ys x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'1443 x21 x21a x21b x22b x51 x2 aa b ys) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51) (create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51)
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ?r'1443 x21 x21a x21b x22b x51 x2 aa b ys x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (23 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> is_aligned x51 pd_bits
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> vmsz_aligned x21 pgsz
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> x21 < kernel_base
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 23 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (22 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> vmsz_aligned x21 pgsz
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> x21 < kernel_base
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 22 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (21 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> x21 < kernel_base
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (21 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> x21 \<le> x21 + 2 ^ pageBitsForSize pgsz - 1
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (20 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q1443 x21 x21a x21b x22b x51 x2 aa b ys x) (?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'1443 x21 x21a x21b x22b x51 x2 aa b ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (20 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' rv\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' rv\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>?Q1612 x21 x21a x21b x22b x51 x2 aa b ys x' s s'\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv sa. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' (Inr rv)\<rbrace>, \<lbrace>\<lambda>rv sa. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' (Inl rv)\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> ?Q1612 x21 x21a x21b x22b x51 x2 aa b ys x' s s' sa
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
A total of 19 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x' s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform sa = s; s' = sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (\<exists>x'a. rv' = Inr x'a \<and> arch_invocation_relation (cdl_invocation.InvokePage x'a) (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))))
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> (\<exists>rv'. (rv' = Inr (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>rv'. (rv' = Inr (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<or> rv' = Inl undefined) \<and> (\<exists>x'a. rv' = Inr x'a \<and> arch_invocation_relation (cdl_invocation.InvokePage x'a) (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))))
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> arch_invocation_relation (cdl_invocation.InvokePage (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None)) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real None) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]))) (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); sa = s \<and> True\<rbrakk> \<Longrightarrow> s = sa
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (12 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 aa b ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 aa b ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = None; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; \<not> kernel_base \<le> x21 + 2 ^ pageBitsForSize pgsz - 1; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz None)) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- doE y <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
whenE (b \<noteq> x21) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 a b ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (a, b); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (a, b)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < a \<and> a < 2 ^ local.asid_bits \<and> vmsz_aligned b pgsz \<and> b < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid a, b))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE x <- whenE (a \<noteq> x2) (throwError (InvalidCapability (Suc 0)));
y <- whenE (b \<noteq> x21) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>a. True) (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) (returnOk () \<sqinter> throw) (lookup_error_on_failure False (find_pd_for_asid x2))
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (16 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk () \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s s' rv sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = s; True\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); (dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')) \<and> (\<not> dev \<longrightarrow> invs s' \<and> valid_etcbs s' \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s' base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s' \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s' \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s')); transform s' = sa; True\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) sa)) \<and> (dc \<oplus> dc) rv' rv
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> x' = x51 \<longrightarrow> is_aligned x21 (pageBitsForSize pgsz) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (doE target_slots <- cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51;
returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') target_slots)
odE \<sqinter> throw) (doE entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<sqinter> throw) (create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51) (create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (20 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and ?uu2847 x21 x21a x21b x22b x51 x2 ab ba ys) (cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51) (create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and ?uu2847 x21 x21a x21b x22b x51 x2 ab ba ys) s
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (20 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys) (\<lambda>a. True) ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) (cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51) (create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ?r'2833 x21 x21a x21b x22b x51 x2 ab ba ys x x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (24 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> is_aligned x51 pd_bits
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> vmsz_aligned x21 pgsz
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> x21 < kernel_base
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; True\<rbrakk> \<Longrightarrow> True
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 24 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (23 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> vmsz_aligned x21 pgsz
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> x21 < kernel_base
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; True\<rbrakk> \<Longrightarrow> True
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 23 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (22 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base\<rbrakk> \<Longrightarrow> x21 < kernel_base
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 22 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (21 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
A total of 21 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (20 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> (typ_at (AArch APageDirectory) x51 and valid_idle and valid_vspace_objs and pspace_aligned and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (20 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x21 < kernel_base; (dev \<longrightarrow> invs s \<and> valid_etcbs s \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> s \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s)) \<and> (\<not> dev \<longrightarrow> invs s \<and> valid_etcbs s \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap s base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> s \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>x\<in>set ys. s \<turnstile> fst x) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) s \<and> (\<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) s)) \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrakk> \<Longrightarrow> typ_at (AArch APageDirectory) x51 s \<and> valid_idle s \<and> valid_vspace_objs s \<and> pspace_aligned s
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 20 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); True\<rbrakk> \<Longrightarrow> True
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 19 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)) s\<rbrakk> \<Longrightarrow> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s) and (\<lambda>a. x21 < kernel_base)) s
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); x = (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]) \<and> (case x' of Inl a \<Rightarrow> (transform_pte \<circ> fst) a | Inr a \<Rightarrow> (transform_pde \<circ> fst) a) = FrameCap False (ptrFromPAddr (addrFromPPtr base)) (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) (?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys x) (?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x') (returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') x) \<sqinter> throw) (doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE)
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>?Q2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ?Q'2833 x21 x21a x21b x22b x51 x2 ab ba ys x s'\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (19 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' rv\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
A total of 19 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' rv\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (18 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>?Q3184 x21 x21a x21b x22b x51 x2 ab ba ys x' s s'\<rbrace> doE y <- ensure_safe_mapping x';
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
odE \<lbrace>\<lambda>rv sa. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' (Inr rv)\<rbrace>, \<lbrace>\<lambda>rv sa. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePage a))) rv' (Inl rv)\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> ?Q3184 x21 x21a x21b x22b x51 x2 ab ba ys x' s s' sa
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
A total of 18 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x' s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None; transform sa = s; s' = sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<sqinter> throw) s)) \<and> (\<exists>x'a. rv' = Inr x'a \<and> arch_invocation_relation (cdl_invocation.InvokePage x'a) (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))))
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> (\<exists>rv'. (rv' = Inr (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>rv'. (rv' = Inr (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair])) \<or> rv' = Inl undefined) \<and> (\<exists>x'a. rv' = Inr x'a \<and> arch_invocation_relation (cdl_invocation.InvokePage x'a) (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))))
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); (case x' of Inl x \<Rightarrow> (transform_pte \<circ> fst) x | Inr x \<Rightarrow> (transform_pde \<circ> fst) x) = FrameCap False base (mask_vm_rights rights (data_to_rights x21a)) (pageBitsForSize pgsz) Fake None\<rbrakk> \<Longrightarrow> arch_invocation_relation (cdl_invocation.InvokePage (cdl_page_invocation.PageMap (FrameCap dev base (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)))) (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) (FrameCap False base (validate_vm_rights (Types_D.cap_rights (FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21))) \<inter> data_to_rights x21a)) (pageBitsForSize pgsz) Fake None) (transform_cslot_ptr invoked_cap_ref') (case x' of Inl pair \<Rightarrow> [(transform_pt_slot_ref \<circ> hd \<circ> snd) pair] | Inr pair \<Rightarrow> [(transform_pd_slot_ref \<circ> hd \<circ> snd) pair]))) (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x'))
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (16 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. True\<rbrace> cdl_page_mapping_entries x21 (pageBitsForSize pgsz) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 x21 && ~~ mask pd_bits)) s)\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>a b. True\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51 \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> True\<rbrace> doE y <- ensure_safe_mapping x;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' x))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x); is_aligned x21 (pageBitsForSize pgsz); sa = s \<and> True\<rbrakk> \<Longrightarrow> s = sa
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (12 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv x21 && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (11 subgoals):
 1. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x21b x22b x51 x2 ab ba ys s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (Some (transform_asid x2, x21)); excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (ab, ba)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21))); invocation_type label' = ArchInvocationLabel ARMPageMap; args' = x21 # x21a # x21b # x22b; intent = PageIntent (PageMapIntent x21 (data_to_rights x21a) x21b); asid = Some (x2, x21); excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), ab, ba) # ys; cap_aligned (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2))); \<forall>x\<in>set ys. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>x. (dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap True base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (ADeviceData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x)) \<and> (\<not> dev \<longrightarrow> invs x \<and> valid_etcbs x \<and> cap_aligned (ArchObjectCap (PageCap False base rights pgsz (Some (x2, x21)))) \<and> (\<exists>ko. kheap x base = Some ko \<and> a_type ko = AArch (AUserData pgsz)) \<and> rights \<in> valid_vm_rights \<and> 0 < x2 \<and> x2 < 2 ^ local.asid_bits \<and> vmsz_aligned x21 pgsz \<and> x21 < kernel_base \<and> x \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<and> (\<forall>xa\<in>set ys. x \<turnstile> fst xa) \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (ab, ba) x \<and> (\<forall>xa\<in>set ys. cte_wp_at ((=) (fst xa)) (snd xa) x))) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x x21 && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz x21;
entries <- create_mapping_entries (addrFromPPtr base) x21 pgsz (mask_vm_rights rights (data_to_rights x21a)) (attribs_from_word x21b) x51;
y <- ensure_safe_mapping entries;
returnOk (arch_invocation.InvokePage (page_invocation.PageMap x2 (ArchObjectCap (PageCap dev base rights pgsz (Some (x2, x21)))) invoked_cap_ref' entries))
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz)) \<sqinter> throw) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (9 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnmap; intent = PageIntent PageUnmapIntent\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_invocation.PageUnmap (transform_mapping asid) base (transform_cslot_ptr invoked_cap_ref') (pageBitsForSize pgsz))) (returnOk (arch_invocation.InvokePage (page_invocation.PageUnmap (PageCap dev base rights pgsz asid) invoked_cap_ref')))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 6. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 6. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (8 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 6. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (11 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (9 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>?Q3453 a b s s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inr rv)\<rbrace>, \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inl rv)\<rbrace>
 2. \<And>a b s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; s' = sa\<rbrakk> \<Longrightarrow> ?Q3453 a b s s' sa
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 8. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (9 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa))) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>s'''. (Inr (PageFlushCaches (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)))), s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa)))
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (9 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')) \<and> (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) = flush.Unify \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) = flush.Clean \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) = flush.CleanInvalidate \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) = flush.Invalidate)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent\<rbrakk> \<Longrightarrow> (asid = None \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))))) \<and> (\<forall>a b. asid = Some (a, b) \<longrightarrow> (Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))) \<and> (\<not> Suc 0 < length args' \<longrightarrow> (isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)) \<and> (\<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress) \<longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base))))))
 7. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>z. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z\<rbrakk> \<Longrightarrow> \<forall>a b. asid = Some (a, b) \<longrightarrow> Suc 0 < length args' \<longrightarrow> isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler) \<longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (16 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')
 2. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) = flush.CleanInvalidate
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageClean_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageClean_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) = flush.CleanInvalidate
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (17 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 17 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (16 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (16 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>?Q3853 a b s s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inr rv)\<rbrace>, \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inl rv)\<rbrace>
 2. \<And>a b s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; s' = sa\<rbrakk> \<Longrightarrow> ?Q3853 a b s s' sa
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa))) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>s'''. (Inr (PageFlushCaches (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)))), s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa)))
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')) \<and> (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) = flush.Unify \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) = flush.Clean \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) = flush.CleanInvalidate \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) = flush.Invalidate)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')
 2. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) = flush.CleanInvalidate
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) = flush.CleanInvalidate
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (16 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 16 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>?Q4184 a b s s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inr rv)\<rbrace>, \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inl rv)\<rbrace>
 2. \<And>a b s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; s' = sa\<rbrakk> \<Longrightarrow> ?Q4184 a b s s' sa
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa))) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>s'''. (Inr (PageFlushCaches (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)))), s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa)))
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')) \<and> (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) = flush.Unify \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) = flush.Clean \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) = flush.CleanInvalidate \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) = flush.Invalidate)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')
 2. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) = flush.CleanInvalidate
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageCleanInvalidate_Data; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageCleanInvalidate_Data); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) = flush.CleanInvalidate
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (12 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (12 subgoals):
 1. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (15 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 15 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction)\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv s''. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' rv\<rbrace>
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (14 subgoals):
 1. \<And>a b s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> \<lbrace>?Q4515 a b s s'\<rbrace> let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inr rv)\<rbrace>, \<lbrace>\<lambda>rv sa. \<exists>rv' s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) s) \<and> (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) rv' (Inl rv)\<rbrace>
 2. \<And>a b s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); True; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); (s, s') \<in> {ss'. transform (snd ss') = fst ss'}; s' = sa\<rbrakk> \<Longrightarrow> ?Q4515 a b s s' sa
 3. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
A total of 14 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa))) \<and> (\<exists>x'. rv' = Inl x')) \<and> (\<exists>s'''. (Inr (PageFlushCaches (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)))), s''') \<in> fst ((returnOk (PageFlushCaches flush.Unify) \<sqinter> returnOk (PageFlushCaches flush.Clean) \<sqinter> returnOk (PageFlushCaches flush.CleanInvalidate) \<sqinter> returnOk (PageFlushCaches flush.Invalidate) \<sqinter> throw) (transform sa)))
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> (\<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')) \<and> (flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) = flush.Unify \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) = flush.Clean \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) = flush.CleanInvalidate \<or> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) = flush.Invalidate)
 2. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); False\<rbrakk> \<Longrightarrow> no_fail (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (13 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (rv' = Inr (PageFlushCaches flush.Unify) \<or> rv' = Inr (PageFlushCaches flush.Clean) \<or> rv' = Inr (PageFlushCaches flush.CleanInvalidate) \<or> rv' = Inr (PageFlushCaches flush.Invalidate) \<or> rv' = Inl undefined) \<and> (\<exists>x'. rv' = Inl x')
 2. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) = flush.CleanInvalidate
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
A total of 13 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (12 subgoals):
 1. \<And>a b sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageUnify_Instruction; intent = PageIntent PageFlushCachesIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageUnify_Instruction); invs sa; valid_etcbs sa; sa \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. sa \<turnstile> fst x; \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) sa; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) \<noteq> flush.Unify; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) \<noteq> flush.Clean; flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) \<noteq> flush.Invalidate\<rbrakk> \<Longrightarrow> flush_type_map (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) = flush.CleanInvalidate
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 10. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 12 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (11 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (11 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError IllegalOperation)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 8. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 9. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
A total of 11 subgoals...
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal (10 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping None); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = None; \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 4. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageGetAddress)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 5. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 6. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (throwError TruncatedMessage)
 7. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageGetAddress; intent = PageIntent PageGetAddressIntent; asid = Some (a, b); \<not> Suc 0 < length args'; \<not> isPageFlushLabel (ArchInvocationLabel ARMPageGetAddress)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePage)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) (returnOk PageGetAddress) (returnOk (arch_invocation.InvokePage (PageGetAddr base)))
 8. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDControlMakePool; (case args' of [] \<Rightarrow> None | [index] \<Rightarrow> None | index # depth # x \<Rightarrow> Some (AsidControlMakePoolIntent index depth)) = Some z; intent = AsidControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDControlMakePool)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDControlMakePool)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 9. \<And>a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMASIDPoolAssign; intent = AsidPoolIntent AsidPoolAssignIntent; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMASIDPoolAssign)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMASIDPoolAssign)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
 10. \<And>z a b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = FrameCap dev base rights (pageBitsForSize pgsz) Real (transform_mapping (Some (a, b))); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMIRQIssueIRQHandler; arch_transform_intent_issue_irq_handler args' = Some z; intent = IrqControlIntent z; asid = Some (a, b); Suc 0 < length args'; isPageFlushLabel (ArchInvocationLabel ARMIRQIssueIRQHandler)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>c. invs c \<and> valid_etcbs c \<and> c \<turnstile> ArchObjectCap (PageCap dev base rights pgsz (Some (a, b))) \<and> (\<forall>x\<in>set excaps'. c \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) c)) throw (let start = args' ! 0; end = args' ! Suc 0 in doE pd <- lookup_error_on_failure False (find_pd_for_asid a);
y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> start \<or> 2 ^ pageBitsForSize pgsz < end) (throwError (InvalidArgument 0));
returnOk (arch_invocation.InvokePage (PageFlush (label_to_flush_type (ArchInvocationLabel ARMIRQIssueIRQHandler)) (start + b) (end + b - 1) (addrFromPPtr base + start) pd a))
odE)
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (prove)
goal:
No subgoals!
flex-flex pairs:
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?g2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2822 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa. ?f2821 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2268 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2265 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?g2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2236 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko. ?f2235 x21 x21a x21b x22b x51 x2 ab ba ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?g1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1432 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa. ?f1431 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko koa (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f990 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f987 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s'))
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?g957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (work_units_completed s')
\<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f958 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko. ?f957 x21 x21a x21b x22b x51 x2 aa b ys sa s' rv a ko (irq_state (machine_state s')) proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (PageCap dev base rights pgsz asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (PageCap dev base rights pgsz asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (PageCap dev base rights pgsz asid)) excaps')

goal (2 subgoals):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 2. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
goal (2 subgoals):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 2. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (2 subgoals):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap x1 x2)) excaps')
 2. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap ptr asid)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap ptr asid)) excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE page_table_intent <- throw_opt undefined (get_page_table_intent intent);
liftME cdl_invocation.InvokePageTable (decode_page_table_invocation (cdl_cap.PageTableCap ptr Real (transform_mapping asid)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') page_table_intent)
odE) (if invocation_type label' = ArchInvocationLabel ARMPageTableMap then if Suc 0 < length args' \<and> excaps' \<noteq> [] then let vaddr = args' ! 0 in doE y <- whenE (\<exists>a b. asid = Some (a, b)) (throwError (InvalidCapability 0));
(pd, asid) <- case fst (excaps' ! 0) of ArchObjectCap (arch_cap.PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- whenE (kernel_base \<le> vaddr) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (pd + (vaddr >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (asid, vaddr && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word (args' ! Suc 0) \<inter> {ParityEnabled}) 0) (pd + (vaddr >> 20 << 2))))
odE else throwError TruncatedMessage else if invocation_type label' = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE else throwError IllegalOperation) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE y <- case transform_mapping asid of None \<Rightarrow> returnOk () | Some a \<Rightarrow> throw;
pd <- throw_on_none (get_index (transform_cap_list excaps') 0);
(pd_object_id, asid) <- case fst pd of cdl_cap.PageDirectoryCap x xa None \<Rightarrow> throw | cdl_cap.PageDirectoryCap x xa (Some asid) \<Rightarrow> returnOk (x, asid) | _ \<Rightarrow> throw;
returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (asid, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot pd_object_id x21))
odE \<sqinter> throw) (if excaps' \<noteq> [] then doE y <- whenE (\<exists>a b. asid = Some (a, b)) (throwError (InvalidCapability 0));
(pd, asid) <- case fst (excaps' ! 0) of ArchObjectCap (arch_cap.PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (arch_cap.PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
y <- whenE (kernel_base \<le> x21) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (pd + (x21 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (asid, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (pd + (x21 >> 20 << 2))))
odE else throwError TruncatedMessage)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid); excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a)\<rbrakk> \<Longrightarrow> \<forall>x51 x2. fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)) \<longrightarrow> excaps' \<noteq> [] \<longrightarrow> asid = None \<longrightarrow> \<not> kernel_base \<le> x21 \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (x51 + (x21 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (2 subgoals):
 1. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE pd' <- lookup_error_on_failure False (find_pd_for_asid x2);
y <- whenE (pd' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> dc) (\<lambda>a. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk () \<sqinter> throw) (lookup_error_on_failure False (find_pd_for_asid x2))
 2. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 3. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (8 subgoals):
 1. \<And>x21 x21a x22a x51 x2 P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk () \<sqinter> throw \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 x21a x22a x51 x2 P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 5. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 6. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a x51 x2 s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv\<rbrace>
 2. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 3. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a x51 x2 s s' rv sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); transform s' = s; True\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) s)) \<and> (dc \<oplus> dc) rv' rv
 2. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 3. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (6 subgoals):
 1. \<And>x21 x21a x22a x51 x2 sa s' rv s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s'); transform s' = sa; True\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst ((returnOk () \<sqinter> throw) sa)) \<and> (dc \<oplus> dc) rv' rv
 2. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 3. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; dc () x'\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x' ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (x' \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE)
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 x'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> x' = x51 \<longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- whenE (oldpde \<noteq> InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od)
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) (\<lambda>a. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- whenE (oldpde \<noteq> InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od)
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 oldpde. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) (\<lambda>a. True) (\<lambda>s. oldpde = InvalidPDE \<longrightarrow> (\<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) s \<and> InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2))) \<and> invs s \<and> valid_etcbs s \<and> s \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (doE y <- whenE (oldpde \<noteq> InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE)
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) (\<lambda>a. True) (\<lambda>s. (\<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) s \<and> InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2))) \<and> invs s \<and> valid_etcbs s \<and> s \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<sqinter> throw) (returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2)))))
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) (\<lambda>a. True) (\<lambda>s. (\<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) s \<and> InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2))) \<and> invs s \<and> valid_etcbs s \<and> s \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s) \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s)) (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21))) (returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2)))))
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (7 subgoals):
 1. \<And>x21 x21a x22a x51 x2 P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) \<lbrace>\<lambda>rv. P\<rbrace>
 2. \<And>x21 x21a x22a x51 x2 P. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>P\<rbrace> returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2)))) \<lbrace>\<lambda>rv. P\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; (\<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) s' \<and> InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2))) \<and> invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s') \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2)))) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) rv' rv\<rbrace>
 4. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 5. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 6. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 s s'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; (\<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) s' \<and> InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2))) \<and> invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s') \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s'); transform s' = s\<rbrakk> \<Longrightarrow> \<lbrace>(=) s'\<rbrace> returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2)))) \<lbrace>\<lambda>rv s''. \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (returnOk (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21)) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) rv' rv\<rbrace>
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 s s' sa. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21; (\<exists>pd. ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) s' \<and> InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2))) \<and> invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s') \<and> (\<exists>ref. (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) s'); transform s' = s; s' = sa\<rbrakk> \<Longrightarrow> \<exists>rv'. (\<exists>s'''. (rv', s''') \<in> fst (return (Inr (cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap ptr Real (Some (transform_asid x2, x21 && ~~ mask 20))) (cdl_cap.PageTableCap ptr Fake None) (transform_cslot_ptr invoked_cap_ref') (cdl_lookup_pd_slot x51 x21))) s)) \<and> (dc \<oplus> (\<lambda>a. arch_invocation_relation (cdl_invocation.InvokePageTable a))) rv' (Inr (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2)))))
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 sa aa b ys pd ref. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); asid = None; \<not> kernel_base \<le> x21; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; invs sa; ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) sa; InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2)); valid_etcbs sa; sa \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None); (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) sa; is_aligned x51 14; sa \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); \<forall>x\<in>set ys. sa \<turnstile> fst x; cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) sa; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) sa; 14 < word_bits; \<forall>x\<in>set ys. is_aligned (obj_ref_of (fst x)) (cap_bits (fst x)) \<and> cap_bits (fst x) < word_bits\<rbrakk> \<Longrightarrow> Some (transform_asid x2, x21 && ~~ mask 20) = transform_mapping (Some (x2, x21 && ~~ mask 20)) \<and> cdl_cap.PageTableCap ptr Fake None = make_arch_duplicate (cdl_cap.PageTableCap ptr Real (transform_mapping (Some (x2, x21 && ~~ mask 20)))) \<and> (x51, unat (x21 >> 20)) = transform_pd_slot_ref (x51 + (x21 >> 20 << 2))
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 sa aa b ys pd ref. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); asid = None; \<not> kernel_base \<le> x21; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; invs sa; ako_at (arch_kernel_obj.PageDirectory pd) (x51 + (x21 >> 20 << 2) && ~~ mask pd_bits) sa; InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2)); valid_etcbs sa; sa \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None); (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) sa; is_aligned x51 14; sa \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); \<forall>x\<in>set ys. sa \<turnstile> fst x; cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) sa; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) sa; 14 < word_bits; \<forall>x\<in>set ys. is_aligned (obj_ref_of (fst x)) (cap_bits (fst x)) \<and> cap_bits (fst x) < word_bits\<rbrakk> \<Longrightarrow> Some (transform_asid x2, x21 && ~~ mask 20) = transform_mapping (Some (x2, x21 && ~~ mask 20)) \<and> x51 = x51 + (x21 >> 20 << 2) && ~~ mask pd_bits \<and> x21 >> 20 = x51 + (x21 >> 20 << 2) && mask pd_bits >> 2
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (5 subgoals):
 1. \<And>x21 x21a x22a x51 x2 sa aa b ys pd ref. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = (cdl_cap.PageDirectoryCap x51 Real (Some (transform_asid x2)), transform_cslot_ptr (aa, b)) # map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) ys; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); asid = None; \<not> kernel_base \<le> x21; excaps' = (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)), aa, b) # ys; invs sa; kheap sa x51 = Some (ArchObj (arch_kernel_obj.PageDirectory pd)); InvalidPDE = pd (UCAST(32 \<rightarrow> 12) (x51 + (x21 >> 20 << 2) && mask pd_bits >> 2)); valid_etcbs sa; sa \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None); (ref \<rhd> (lookup_pd_slot x51 ab && ~~ mask pd_bits)) sa; is_aligned x51 14; sa \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); \<forall>x\<in>set ys. sa \<turnstile> fst x; cte_wp_at ((=) (ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)))) (aa, b) sa; \<forall>x\<in>set ys. cte_wp_at ((=) (fst x)) (snd x) sa; 14 < word_bits; \<forall>x\<in>set ys. is_aligned (obj_ref_of (fst x)) (cap_bits (fst x)) \<and> cap_bits (fst x) < word_bits\<rbrakk> \<Longrightarrow> x21 >> 20 = x51 + (x21 >> 20 << 2) && mask pd_bits >> 2
 2. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (4 subgoals):
 1. \<And>x21 x21a x22a x51 x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>rv. (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot rv ab && ~~ mask pd_bits)) s)\<rbrace>, \<lbrace>\<lambda>_ _. True\<rbrace>
 2. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (3 subgoals):
 1. \<And>x21 x21a x22a x51 x2 s. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>(=) s\<rbrace> lookup_error_on_failure False (find_pd_for_asid x2) \<lbrace>\<lambda>_. (=) s\<rbrace>
 2. \<And>x21 x21a x22a x51 x2 s x. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real None; excaps = map (\<lambda>(cap, slot). (transform_cap cap, transform_cslot_ptr slot)) excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableMap; args' = x21 # x21a # x22a; intent = PageTableIntent (PageTableMapIntent x21 x21a); fst (excaps' ! 0) = ArchObjectCap (arch_cap.PageDirectoryCap x51 (Some x2)); excaps' \<noteq> []; asid = None; \<not> kernel_base \<le> x21\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s'. s' = s \<and> ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and (\<lambda>s. \<exists>ref. (ref \<rhd> (lookup_pd_slot x ab && ~~ mask pd_bits)) s)) s'\<rbrace> doE y <- whenE (x \<noteq> x51) (throwError (InvalidCapability (Suc 0)));
do oldpde <- get_master_pde (x51 + (x21 >> 20 << 2));
doE y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap ptr (Some (x2, x21 && ~~ mask 20)))) invoked_cap_ref' (PageTablePDE (addrFromPPtr ptr) (attribs_from_word x21a \<inter> {ParityEnabled}) 0) (x51 + (x21 >> 20 << 2))))
odE
od
odE \<lbrace>\<lambda>_ _. True\<rbrace>, \<lbrace>\<lambda>_. (=) s\<rbrace>
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (IpcCancel_A.is_final_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid)));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (doE final <- liftE (gets (IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap ptr asid))));
y <- unlessE final (throwError RevokeFirst);
returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
odE)
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageTable)) (\<lambda>_. True) ((\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) and IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap ptr asid))) (returnOk (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref')) \<sqinter> throw) (returnOk (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref')))
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageTableCap ptr Real (transform_mapping asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageTableCap ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPageTableUnmap; intent = PageTableIntent PageTableUnmapIntent\<rbrakk> \<Longrightarrow> (\<exists>s'. invs s' \<and> valid_etcbs s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid) \<and> (\<forall>x\<in>set excaps'. s' \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s') \<and> IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap ptr asid)) s') \<longrightarrow> arch_invocation_relation (cdl_invocation.InvokePageTable (cdl_page_table_invocation.PageTableUnmap (transform_mapping asid) ptr (transform_cslot_ptr invoked_cap_ref'))) (arch_invocation.InvokePageTable (page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap ptr asid)) invoked_cap_ref'))
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (prove)
goal:
No subgoals!
flex-flex pairs:
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g686 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s') \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?g685 x21 x21a x22a x51 x2 sa s' rv a (work_units_completed s')
\<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f686 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) \<equiv>\<^sup>? \<lambda>x21 x21a x22a x51 x2 sa s' rv a. ?f685 x21 x21a x22a x51 x2 sa s' rv a (irq_state (machine_state s')) proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (arch_cap.PageTableCap ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageTableCap ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageTableCap ptr asid)) excaps')

goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (state)
this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. \<And>x1 x2. \<lbrakk>Some intent = transform_intent (invocation_type label') args'; invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap x1 x2); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and valid_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap x1 x2)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)) excaps') proof (prove)
using this:
Some intent = transform_intent (invocation_type label') args'
invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'
invoked_cap = transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid))
excaps = transform_cap_list excaps'
invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)
\<forall>x\<in>set excaps'. cap_aligned (fst x)

goal (1 subgoal):
 1. dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)) excaps') proof (prove)
goal (1 subgoal):
 1. \<lbrakk>Some intent = (case invocation_type label' of GenInvocationLabel InvalidInvocation \<Rightarrow> None | GenInvocationLabel UntypedRetype \<Rightarrow> map_option UntypedIntent (transform_intent_untyped_retype args') | GenInvocationLabel TCBReadRegisters \<Rightarrow> map_option TcbIntent (transform_intent_tcb_read_registers args') | GenInvocationLabel TCBWriteRegisters \<Rightarrow> map_option TcbIntent (transform_intent_tcb_write_registers args') | GenInvocationLabel TCBCopyRegisters \<Rightarrow> map_option TcbIntent (transform_intent_tcb_copy_registers args') | GenInvocationLabel TCBConfigure \<Rightarrow> map_option TcbIntent (transform_intent_tcb_configure args') | GenInvocationLabel TCBSetPriority \<Rightarrow> map_option TcbIntent (transform_intent_tcb_set_priority args') | GenInvocationLabel TCBSetMCPriority \<Rightarrow> map_option TcbIntent (transform_intent_tcb_set_mcpriority args') | GenInvocationLabel TCBSetSchedParams \<Rightarrow> map_option TcbIntent (transform_intent_tcb_set_sched_params args') | GenInvocationLabel TCBSetIPCBuffer \<Rightarrow> map_option TcbIntent (transform_intent_tcb_set_ipc_buffer args') | GenInvocationLabel TCBSetSpace \<Rightarrow> map_option TcbIntent (transform_intent_tcb_set_space args') | GenInvocationLabel TCBSuspend \<Rightarrow> Some (TcbIntent TcbSuspendIntent) | GenInvocationLabel TCBResume \<Rightarrow> Some (TcbIntent TcbResumeIntent) | GenInvocationLabel TCBBindNotification \<Rightarrow> Some (TcbIntent TcbBindNTFNIntent) | GenInvocationLabel TCBUnbindNotification \<Rightarrow> Some (TcbIntent TcbUnbindNTFNIntent) | GenInvocationLabel TCBSetTLSBase \<Rightarrow> Some (TcbIntent TcbSetTLSBaseIntent) | GenInvocationLabel CNodeRevoke \<Rightarrow> map_option CNodeIntent (transform_cnode_index_and_depth CNodeRevokeIntent args') | GenInvocationLabel CNodeDelete \<Rightarrow> map_option CNodeIntent (transform_cnode_index_and_depth CNodeDeleteIntent args') | GenInvocationLabel CNodeCancelBadgedSends \<Rightarrow> map_option CNodeIntent (transform_cnode_index_and_depth CNodeCancelBadgedSendsIntent args') | GenInvocationLabel CNodeCopy \<Rightarrow> map_option CNodeIntent (transform_intent_cnode_copy args') | GenInvocationLabel CNodeMint \<Rightarrow> map_option CNodeIntent (transform_intent_cnode_mint args') | GenInvocationLabel CNodeMove \<Rightarrow> map_option CNodeIntent (transform_intent_cnode_move args') | GenInvocationLabel CNodeMutate \<Rightarrow> map_option CNodeIntent (transform_intent_cnode_mutate args') | GenInvocationLabel CNodeRotate \<Rightarrow> map_option CNodeIntent (transform_intent_cnode_rotate args') | GenInvocationLabel CNodeSaveCaller \<Rightarrow> map_option CNodeIntent (transform_cnode_index_and_depth CNodeSaveCallerIntent args') | GenInvocationLabel IRQIssueIRQHandler \<Rightarrow> map_option IrqControlIntent (transform_intent_issue_irq_handler args') | GenInvocationLabel IRQAckIRQ \<Rightarrow> Some (IrqHandlerIntent IrqHandlerAckIntent) | GenInvocationLabel IRQSetIRQHandler \<Rightarrow> Some (IrqHandlerIntent IrqHandlerSetEndpointIntent) | GenInvocationLabel IRQClearIRQHandler \<Rightarrow> Some (IrqHandlerIntent IrqHandlerClearIntent) | GenInvocationLabel DomainSetSet \<Rightarrow> map_option DomainIntent (transform_intent_domain args') | ArchInvocationLabel ARMPageTableMap \<Rightarrow> map_option PageTableIntent (transform_intent_page_table_map args') | ArchInvocationLabel ARMPageTableUnmap \<Rightarrow> Some (PageTableIntent PageTableUnmapIntent) | ArchInvocationLabel ARMPageMap \<Rightarrow> map_option PageIntent (transform_intent_page_map args') | ArchInvocationLabel ARMPageUnmap \<Rightarrow> Some (PageIntent PageUnmapIntent) | ArchInvocationLabel ARMPageClean_Data \<Rightarrow> Some (PageIntent PageFlushCachesIntent) | ArchInvocationLabel ARMPageInvalidate_Data \<Rightarrow> Some (PageIntent PageFlushCachesIntent) | ArchInvocationLabel ARMPageCleanInvalidate_Data \<Rightarrow> Some (PageIntent PageFlushCachesIntent) | ArchInvocationLabel ARMPageUnify_Instruction \<Rightarrow> Some (PageIntent PageFlushCachesIntent) | ArchInvocationLabel ARMPageGetAddress \<Rightarrow> Some (PageIntent PageGetAddressIntent) | ArchInvocationLabel ARMASIDControlMakePool \<Rightarrow> map_option AsidControlIntent (transform_cnode_index_and_depth AsidControlMakePoolIntent args') | ArchInvocationLabel ARMASIDPoolAssign \<Rightarrow> Some (AsidPoolIntent AsidPoolAssignIntent) | ArchInvocationLabel ARMIRQIssueIRQHandler \<Rightarrow> map_option IrqControlIntent (arch_transform_intent_issue_irq_handler args') | ArchInvocationLabel _ \<Rightarrow> Some (PageDirectoryIntent PageDirectoryFlushIntent)); invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x)\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> (\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (doE page_directory_intent <- throw_opt undefined (case intent of PageDirectoryIntent x \<Rightarrow> Some x | _ \<Rightarrow> None);
liftME cdl_invocation.InvokePageDirectory (decode_page_directory_invocation (cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid)) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') page_directory_intent)
odE) (if case invocation_type label' of GenInvocationLabel gen_invocation_labels \<Rightarrow> False | ArchInvocationLabel ARMPDClean_Data \<Rightarrow> True | ArchInvocationLabel ARMPDInvalidate_Data \<Rightarrow> True | ArchInvocationLabel ARMPDCleanInvalidate_Data \<Rightarrow> True | ArchInvocationLabel ARMPDUnify_Instruction \<Rightarrow> True | ArchInvocationLabel _ \<Rightarrow> False then if 1 < length args' then let start = args' ! 0; end = args' ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case arch_cap.PageDirectoryCap pd_ptr asid of arch_cap.PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | arch_cap.PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ arch_invocation.InvokePageDirectory $ page_directory_invocation.PageDirectoryFlush (label_to_flush_type (invocation_type label')) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> start \<or> kernel_base < end) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd start) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size in doE y <- whenE (base_start \<noteq> page_base (end - 1) frame_size) (throwError (RangeError start (base_start + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDClean_Data)) start (end - 1) (frame_base + (start && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> start \<or> kernel_base < end) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd start) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size in doE y <- whenE (base_start \<noteq> page_base (end - 1) frame_size) (throwError (RangeError start (base_start + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDInvalidate_Data)) start (end - 1) (frame_base + (start && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> start \<or> kernel_base < end) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd start) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size in doE y <- whenE (base_start \<noteq> page_base (end - 1) frame_size) (throwError (RangeError start (base_start + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDCleanInvalidate_Data)) start (end - 1) (frame_base + (start && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDUnify_Instruction; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (let start = args' ! 0; end = args' ! Suc 0 in doE y <- whenE (end \<le> start) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> start \<or> kernel_base < end) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd start) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size in doE y <- whenE (base_start \<noteq> page_base (end - 1) frame_size) (throwError (RangeError start (base_start + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDUnify_Instruction)) start (end - 1) (frame_base + (start && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage)) proof (prove)
goal (4 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDClean_Data)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage))
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDCleanInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDUnify_Instruction; intent = PageDirectoryIntent PageDirectoryFlushIntent\<rbrakk> \<Longrightarrow> (Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDUnify_Instruction)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)) \<and> (\<not> Suc 0 < length args' \<longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage)) proof (prove)
goal (8 subgoals):
 1. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDClean_Data)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)
 2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; \<not> Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage)
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; \<not> Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage)
 5. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDCleanInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)
 6. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; \<not> Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage)
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDUnify_Instruction; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (doE y <- whenE (args' ! Suc 0 \<le> args' ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> args' ! 0 \<or> kernel_base < args' ! Suc 0) (throwError IllegalOperation);
(pd, asid) <- case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid asid);
y <- whenE (pd' \<noteq> pd) (throwError (InvalidCapability 0));
liftE (resolve_vaddr pd (args' ! 0)) >>=E case_option (returnOk (arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing)) (\<lambda>(frame_size, frame_base). doE y <- whenE (page_base (args' ! 0) frame_size \<noteq> page_base (args' ! Suc 0 - 1) frame_size) (throwError (RangeError (args' ! 0) (page_base (args' ! 0) frame_size + mask (pageBitsForSize frame_size))));
returnOk (arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDUnify_Instruction)) (args' ! 0) (args' ! Suc 0 - 1) (frame_base + (args' ! 0 && mask (pageBitsForSize frame_size))) pd asid))
odE)
odE)
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDUnify_Instruction; intent = PageDirectoryIntent PageDirectoryFlushIntent; \<not> Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (returnOk cdl_page_directory_invocation.PageDirectoryNothing \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Unify) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Clean) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate) \<sqinter> returnOk (cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate) \<sqinter> throw) (throwError TruncatedMessage) proof (prove)
goal (16 subgoals):
 1. \<And>a b rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case rv' of None \<Rightarrow> select_ret_or_throw {arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing} {} | Some p \<Rightarrow> doE y <- select_ret_or_throw {x. page_base (args' ! 0) (fst p) = page_base (args' ! Suc 0 - 1) (fst p)} {x. x = RangeError (args' ! 0) (page_base (args' ! 0) (fst p) + mask (pageBitsForSize (fst p))) \<and> page_base (args' ! 0) (fst p) \<noteq> page_base (args' ! Suc 0 - 1) (fst p)};
select_ret_or_throw {arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDClean_Data)) (args' ! 0) (args' ! Suc 0 - 1) (snd p + (args' ! 0 && mask (pageBitsForSize (fst p)))) (fst (a, b)) (snd (a, b)))} {}
odE)
 2. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 3. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid))
 5. \<And>a b rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case rv' of None \<Rightarrow> select_ret_or_throw {arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing} {} | Some p \<Rightarrow> doE y <- select_ret_or_throw {x. page_base (args' ! 0) (fst p) = page_base (args' ! Suc 0 - 1) (fst p)} {x. x = RangeError (args' ! 0) (page_base (args' ! 0) (fst p) + mask (pageBitsForSize (fst p))) \<and> page_base (args' ! 0) (fst p) \<noteq> page_base (args' ! Suc 0 - 1) (fst p)};
select_ret_or_throw {arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (snd p + (args' ! 0 && mask (pageBitsForSize (fst p)))) (fst (a, b)) (snd (a, b)))} {}
odE)
 6. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 7. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid))
 9. \<And>a b rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case rv' of None \<Rightarrow> select_ret_or_throw {arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing} {} | Some p \<Rightarrow> doE y <- select_ret_or_throw {x. page_base (args' ! 0) (fst p) = page_base (args' ! Suc 0 - 1) (fst p)} {x. x = RangeError (args' ! 0) (page_base (args' ! 0) (fst p) + mask (pageBitsForSize (fst p))) \<and> page_base (args' ! 0) (fst p) \<noteq> page_base (args' ! Suc 0 - 1) (fst p)};
select_ret_or_throw {arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDCleanInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (snd p + (args' ! 0 && mask (pageBitsForSize (fst p)))) (fst (a, b)) (snd (a, b)))} {}
odE)
 10. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a b rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case rv' of None \<Rightarrow> select_ret_or_throw {arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing} {} | Some p \<Rightarrow> doE y <- select_ret_or_throw {x. page_base (args' ! 0) (fst p) = page_base (args' ! Suc 0 - 1) (fst p)} {x. x = RangeError (args' ! 0) (page_base (args' ! 0) (fst p) + mask (pageBitsForSize (fst p))) \<and> page_base (args' ! 0) (fst p) \<noteq> page_base (args' ! Suc 0 - 1) (fst p)};
select_ret_or_throw {arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDClean_Data)) (args' ! 0) (args' ! Suc 0 - 1) (snd p + (args' ! 0 && mask (pageBitsForSize (fst p)))) (fst (a, b)) (snd (a, b)))} {}
odE)
 2. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 3. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
 4. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid))
 5. \<And>a b rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case rv' of None \<Rightarrow> select_ret_or_throw {arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing} {} | Some p \<Rightarrow> doE y <- select_ret_or_throw {x. page_base (args' ! 0) (fst p) = page_base (args' ! Suc 0 - 1) (fst p)} {x. x = RangeError (args' ! 0) (page_base (args' ! 0) (fst p) + mask (pageBitsForSize (fst p))) \<and> page_base (args' ! 0) (fst p) \<noteq> page_base (args' ! Suc 0 - 1) (fst p)};
select_ret_or_throw {arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (snd p + (args' ! 0 && mask (pageBitsForSize (fst p)))) (fst (a, b)) (snd (a, b)))} {}
odE)
 6. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 7. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
 8. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case asid of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (pd_ptr, asid))
 9. \<And>a b rv'. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> ((\<lambda>x. (\<lambda>rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation x ai) \<circ> InvokeArchObject) \<circ> cdl_invocation.InvokePageDirectory)) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (case rv' of None \<Rightarrow> select_ret_or_throw {arch_invocation.InvokePageDirectory page_directory_invocation.PageDirectoryNothing} {} | Some p \<Rightarrow> doE y <- select_ret_or_throw {x. page_base (args' ! 0) (fst p) = page_base (args' ! Suc 0 - 1) (fst p)} {x. x = RangeError (args' ! 0) (page_base (args' ! 0) (fst p) + mask (pageBitsForSize (fst p))) \<and> page_base (args' ! 0) (fst p) \<noteq> page_base (args' ! Suc 0 - 1) (fst p)};
select_ret_or_throw {arch_invocation.InvokePageDirectory (page_directory_invocation.PageDirectoryFlush (label_to_flush_type (ArchInvocationLabel ARMPDCleanInvalidate_Data)) (args' ! 0) (args' ! Suc 0 - 1) (snd p + (args' ! 0 && mask (pageBitsForSize (fst p)))) (fst (a, b)) (snd (a, b)))} {}
odE)
 10. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 2. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
 3. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real None; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'; asid = None\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (throwError (InvalidCapability 0))
 4. \<And>x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (Some (transform_asid x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr (Some x2)); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDClean_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'; asid = Some x2\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr (Some x2)) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (returnOk (pd_ptr, x2))
 5. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 6. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
 7. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real None; excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr None); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'; asid = None\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr None) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (throwError (InvalidCapability 0))
 8. \<And>x2. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (Some (transform_asid x2)); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr (Some x2)); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'; asid = Some x2\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr (Some x2)) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (returnOk (pd_ptr, x2))
 9. \<And>a. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (liftE (resolve_vaddr a (args' ! 0)))
 10. \<And>b. \<lbrakk>invoked_cap_ref = transform_cslot_ptr invoked_cap_ref'; invoked_cap = cdl_cap.PageDirectoryCap pd_ptr Real (map_option transform_asid asid); excaps = transform_cap_list excaps'; invoked_cap' = ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid); \<forall>x\<in>set excaps'. cap_aligned (fst x); invocation_type label' = ArchInvocationLabel ARMPDCleanInvalidate_Data; intent = PageDirectoryIntent PageDirectoryFlushIntent; Suc 0 < length args'\<rbrakk> \<Longrightarrow> dcorres ((\<lambda>a b. True) \<oplus> dc) (\<lambda>_. True) (\<lambda>a. invs a \<and> valid_etcbs a \<and> a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid) \<and> (\<forall>x\<in>set excaps'. a \<turnstile> fst x) \<and> (\<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) a)) (select_ret_or_throw {cdl_page_directory_invocation.PageDirectoryFlush flush.Invalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.CleanInvalidate, cdl_page_directory_invocation.PageDirectoryFlush flush.Clean, cdl_page_directory_invocation.PageDirectoryFlush flush.Unify, cdl_page_directory_invocation.PageDirectoryNothing} {undefined}) (lookup_error_on_failure False (find_pd_for_asid b))
A total of 16 subgoals... proof (prove)
goal:
No subgoals! proof (state)
this:
dcorres (dc \<oplus> (\<lambda>rv rv'. \<exists>ai. rv' = InvokeArchObject ai \<and> arch_invocation_relation rv ai)) (\<lambda>_. True) (invs and valid_etcbs and (\<lambda>a. a \<turnstile> ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)) and (\<lambda>s. \<forall>x\<in>set excaps'. s \<turnstile> fst x) and (\<lambda>s. \<forall>x\<in>set excaps'. cte_wp_at ((=) (fst x)) (snd x) s)) (Decode_D.decode_invocation (transform_cap (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid))) (transform_cslot_ptr invoked_cap_ref') (transform_cap_list excaps') intent) (Decode_A.decode_invocation label' args' cap_index' invoked_cap_ref' (ArchObjectCap (arch_cap.PageDirectoryCap pd_ptr asid)) excaps')

goal:
No subgoals!