theory Arch_C

lemma performPageInvocationMapPDE_ccorres:
  "ccorres (K (K \<bottom>) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and cte_at' slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s)
              and valid_pde_slots'2 mapping and (\<lambda>s. asid \<le> mask asid_bits))
       (UNIV \<inter> {s. pde_range_relation (snd (theRight mapping)) (pde_entries_' s)}
             \<inter> {s. cpde_relation (fst (theRight mapping)) (pde_' s)}
             \<inter> {s. ccap_relation cap (cap_' s)}
             \<inter> {s. ctSlot_' s = cte_Ptr slot}
             \<inter> {s. asid_' s = asid}
             \<inter> {s. isRight mapping}) []
       (liftE (performPageInvocation (PageMap asid cap slot mapping)))
       (Call performPageInvocationMapPDE_'proc)" apply (rule ccorres_gen_asm) apply (rule ccorres_gen_asm2) apply (simp only: liftE_liftM ccorres_liftM_simp) apply (cinit lift: pde_entries_' pde_' cap_' ctSlot_' asid_' ) apply (rule_tac P="\<exists>s. valid_pde_slots'2 mapping s" in ccorres_gen_asm) apply (rule ccorres_gen_asm [where P ="snd (theRight mapping)\<noteq>[]"]) apply (clarsimp simp: isRight_def bind_assoc simp del: Collect_const) apply (ctac (no_vcg)) apply (ctac (no_vcg) add: pdeCheckIfMapped_ccorres) apply csymbr apply (simp add: mapM_discarded whileAnno_def
                       Collect_False
                  del: Collect_const) apply (rule ccorres_Guard_Seq) apply (rule ccorres_basic_srnoop2, simp) apply csymbr apply (rule ccorres_split_nothrow_novcg) apply (rule_tac F="\<lambda>_. valid_pde_slots'2 mapping" in ccorres_mapM_x_while' [where i=0]) apply clarsimp apply (rule ccorres_guard_imp2) apply (rule ccorres_Guard[where F=MemorySafety]
                    | (rule ccorres_flip_Guard, rule ccorres_Guard[where F=MemorySafety]))+ apply (rule storePDE_Basic_ccorres', simp) apply clarsimp apply (clarsimp simp: pde_range_relation_def ptr_range_to_list_def
                                    valid_pde_slots'2_def ucast_nat_def ucast_minus
                                    of_nat_ucast) apply (erule disjE, simp_all)[1] apply (simp add: upt_conv_Cons[where i=0]) apply (subst array_assertion_abs_pde_16_no_lookup, erule conjI,
                clarsimp simp: unat_of_nat of_nat_gt_0)+ apply simp apply (clarsimp simp: pde_range_relation_def ptr_range_to_list_def) apply vcg apply simp apply (wpsimp wp: valid_pde_slots_lift2) apply clarsimp apply (clarsimp simp: pde_range_relation_def ptr_range_to_list_def) apply (rule order_less_le_trans) apply (rule unat_lt2p) apply (simp add: word_bits_def) apply ceqv apply (rule_tac P="valid_pde_slots'2 mapping" in ccorres_cross_over_guard) apply csymbr apply (rule ccorres_move_c_guard_pde
                    ccorres_move_array_assertion_pde_16_2 ccorres_Guard_Seq
                    ccorres_rhs_assoc)+ apply (ctac(no_vcg) add: cleanCacheRange_PoU_ccorres) apply (rule ccorres_move_c_guard_pde
                     ccorres_move_array_assertion_pde_16_2 ccorres_Guard_Seq
                     ccorres_rhs_assoc)+ apply (simp add: when_def del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: to_bool_def) apply (ctac (no_vcg) add: invalidateTLBByASID_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp:return_def) apply wp [1] apply simp apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp:return_def) apply (wp hoare_vcg_const_imp_lift) [1] apply clarsimp apply (rule hoare_strengthen_post) apply (rule_tac Q'="\<lambda>rv s. valid_pde_mappings' s
                \<and> valid_pde_slots'2 mapping s
                \<and> unat (last (snd (theRight mapping)) + 3
                    - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s" in hoare_vcg_conj_lift) apply (rule mapM_x_accumulate_checks) apply (simp add: storePDE_def) apply (rule obj_at_setObject3) apply simp apply (simp add: objBits_simps archObjSize_def pdeBits_def) apply (simp add: typ_at_to_obj_at_arches[symmetric]) apply (wp mapM_x_storePDE_pde_mappings' mapM_x_wp' valid_pde_slots_lift2 | simp)+ apply clarsimp apply (simp add: typ_at_to_obj_at_arches) apply (frule bspec, erule hd_in_set) apply (drule bspec, erule last_in_set) apply (simp add: hd_conv_nth last_conv_nth) apply (rule conj_assoc[where Q="a \<le> b" for a b, THEN iffD1])+ apply (rule conjI) 
 (* the inequality first *)
         apply (clarsimp simp:valid_pde_slots'2_def pdeBits_def
          objBits_simps archObjSize_def hd_conv_nth) apply (clarsimp simp:pde_range_relation_def ptr_range_to_list_def ptr_add_def) apply (frule is_aligned_addrFromPPtr_n,simp) apply (cut_tac n = "sz+2" in  power_not_zero[where 'a="32"]) apply simp apply (subst is_aligned_no_wrap', assumption, fastforce) apply (subst add_diff_eq [symmetric]) apply (subst is_aligned_no_wrap', assumption, fastforce) apply (simp add:addrFromPPtr_mask_5) apply (clarsimp simp: pde_range_relation_def ptr_range_to_list_def CTypesDefs.ptr_add_def
                             valid_pde_slots'2_def addrFromPPtr_mask_5) apply (auto simp: upt_conv_Cons[where i=0])[1] apply (clarsimp simp: guard_is_UNIV_def Collect_const_mem hd_conv_nth last_conv_nth) apply (clarsimp simp: pde_range_relation_def ptr_range_to_list_def pdeBits_def) apply (simp add: CTypesDefs.ptr_add_def ucast_nat_def ucast_minus objBits_simps archObjSize_def
        word_0_sle_from_less) apply (clarsimp simp: valid_pde_slots'2_def del: disjCI) apply (erule disjE, simp_all add: unat_arith_simps)[1] apply (clarsimp simp: upt_conv_Cons[where i=0]) apply (wp valid_pde_slots_lift2 | simp add: pdeBits_def)+ apply (clarsimp simp: pde_range_relation_def map_is_Nil_conv hd_map_simp
                         ptr_range_to_list_def valid_pde_slots'2_def
                         word_le_nat_alt power_increasing[where a="2 :: nat" and N=4, simplified]) apply (clarsimp simp: pde_range_relation_def ptr_range_to_list_def unat_1_0
                        valid_pde_slots'2_def isRight_def last_map hd_map
                        ptr_add_def) apply (auto simp: unat_arith_simps unat_word_ariths) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping and (\<lambda>s. asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>pde_range_relation (snd (theRight mapping)) \<acute>pde_entries\<rbrace> \<inter> \<lbrace>cpde_relation (fst (theRight mapping)) \<acute>pde\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>isRight mapping\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageMap asid cap slot mapping))) (Call performPageInvocationMapPDE_'proc) proof (prove)
goal (1 subgoal):
 1. asid \<le> mask local.asid_bits \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) (UNIV \<inter> \<lbrace>pde_range_relation (snd (theRight mapping)) \<acute>pde_entries\<rbrace> \<inter> \<lbrace>cpde_relation (fst (theRight mapping)) \<acute>pde\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>isRight mapping\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageMap asid cap slot mapping))) (Call performPageInvocationMapPDE_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) (UNIV \<inter> \<lbrace>pde_range_relation (snd (theRight mapping)) \<acute>pde_entries\<rbrace> \<inter> \<lbrace>cpde_relation (fst (theRight mapping)) \<acute>pde\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageMap asid cap slot mapping))) (Call performPageInvocationMapPDE_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) (UNIV \<inter> \<lbrace>pde_range_relation (snd (theRight mapping)) \<acute>pde_entries\<rbrace> \<inter> \<lbrace>cpde_relation (fst (theRight mapping)) \<acute>pde\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (performPageInvocation (ARM_H.PageMap asid cap slot mapping)) (Call performPageInvocationMapPDE_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>asida ctSlot capa pde pde_entries. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2252 asida ctSlot capa pde pde_entries) (?Q'2252 asida ctSlot capa pde pde_entries) [SKIP] (do y <- updateCap slot cap;
y <- case mapping of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(ctSlot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pdeCheckIfMapped_'proc(pde_range_C.base_C pde_entries);;
(\<acute>j :== pde_range_C.length_C pde_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asida)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2252 asida ctSlot capa pde pde_entries s \<and> s' \<in> ?Q'2252 asida ctSlot capa pde pde_entries proof (prove)
goal (2 subgoals):
 1. \<And>asida ctSlot capa pde pde_entries. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; \<exists>s. valid_pde_slots'2 mapping s\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2258 asida ctSlot capa pde pde_entries) (?Q'2252 asida ctSlot capa pde pde_entries) [SKIP] (do y <- updateCap slot cap;
y <- case mapping of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(ctSlot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pdeCheckIfMapped_'proc(pde_range_C.base_C pde_entries);;
(\<acute>j :== pde_range_C.length_C pde_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asida)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2258 asida ctSlot capa pde pde_entries and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> ?Q'2252 asida ctSlot capa pde pde_entries proof (prove)
goal (2 subgoals):
 1. \<And>asida ctSlot capa pde pde_entries. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; \<exists>s. valid_pde_slots'2 mapping s; snd (theRight mapping) \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2259 asida ctSlot capa pde pde_entries) (?Q'2252 asida ctSlot capa pde pde_entries) [SKIP] (do y <- updateCap slot cap;
y <- case mapping of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(ctSlot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pdeCheckIfMapped_'proc(pde_range_C.base_C pde_entries);;
(\<acute>j :== pde_range_C.length_C pde_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asida)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2259 asida ctSlot capa pde pde_entries and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> ?Q'2252 asida ctSlot capa pde pde_entries proof (prove)
goal (2 subgoals):
 1. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2259 asid (cte_Ptr slot) capa pde pde_entries) (?Q'2252 asid (cte_Ptr slot) capa pde pde_entries) [SKIP] (do y <- updateCap slot cap;
x <- pdeCheckIfMapped (hd b);
xa <- mapM (swp storePDE a) b;
xa <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when x (invalidateTLBByASID asid);
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pdeCheckIfMapped_'proc(pde_range_C.base_C pde_entries);;
(\<acute>j :== pde_range_C.length_C pde_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2259 asida ctSlot capa pde pde_entries and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> ?Q'2252 asida ctSlot capa pde pde_entries proof (prove)
goal (4 subgoals):
 1. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2285 capa pde pde_entries a s b rv) (?Q'2285 capa pde pde_entries a s b rv xfdc) [SKIP] (do x <- pdeCheckIfMapped (hd b);
xa <- mapM (swp storePDE a) b;
xa <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when x (invalidateTLBByASID asid);
return []
od) (\<acute>tlbflush_required :== CALL pdeCheckIfMapped_'proc(pde_range_C.base_C pde_entries);;
(\<acute>j :== pde_range_C.length_C pde_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>?Q2285 capa pde pde_entries a s b\<rbrace>
 3. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> ?Q'2285 capa pde pde_entries a s b rv (xfdc sa)
 4. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b rv xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc; rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pde pde_entries a s b rv xfdc rva) (?Q'2319 capa pde pde_entries a s b rv xfdc rva tlbflush_required) [SKIP] (do x <- mapM (swp storePDE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when rva (invalidateTLBByASID asid);
return []
od) (\<acute>j :== pde_range_C.length_C pde_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>?Q2319 capa pde pde_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'2319 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b rv xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc; rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pde pde_entries a s b rv xfdc rva) (?G'2598 capa pde pde_entries a s b rv xfdc rva tlbflush_required) [SKIP] (do x <- mapM (swp storePDE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when rva (invalidateTLBByASID asid);
return []
od) (Guard GhostStateError \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pde_range_C.length_C pde_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>?Q2319 capa pde pde_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) sb \<in> ?G'2598 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2598 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePDE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (Guard GhostStateError \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < pde_range_C.length_C pde_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>?Q2319 capa pde pde_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) sb \<in> ?G'2598 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)) (?C'2847 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePDE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>globals :== ghost'state_'_update id;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < pde_range_C.length_C pde_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>?Q2319 capa pde pde_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) sb \<in> ?C'2847 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t) \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2854 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePDE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < pde_range_C.length_C pde_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>?Q2319 capa pde pde_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) sb \<in> {sb. globals_update (ghost'state_'_update id) sb \<in> ?G'2854 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2866 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePDE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (While \<lbrace>\<acute>i < pde_range_C.length_C pde_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>?Q2319 capa pde pde_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) sb \<in> {sb. globals_update (ghost'state_'_update id) sb \<in> {sb. i_'_update (\<lambda>_. 0) sb \<in> ?G'2866 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (?r'2969 capa pde pde_entries a s b xfdc rva tlbflush_required) (?xf'2969 capa pde pde_entries a s b xfdc rva tlbflush_required) (?P2975 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2866 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [] (mapM_x (swp storePDE a) b) (While \<lbrace>\<acute>i < pde_range_C.length_C pde_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2969 capa pde pde_entries a s b xfdc rva tlbflush_required) rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; ?r'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2969 capa pde pde_entries a s b xfdc rva tlbflush_required) (?xf'2969 capa pde pde_entries a s b xfdc rva tlbflush_required) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. ?P2975 capa pde pde_entries a s b rv xfdc c and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) sb \<in> {sb. globals_update (ghost'state_'_update id) sb \<in> {sb. i_'_update (\<lambda>_. 0) sb \<in> ?G'2866 capa pde pde_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>n<length b. ccorres dc xfdc (valid_pde_slots'2 mapping) \<lbrace>\<acute>i = word_of_nat 0 + word_of_nat n\<rbrace> [] (swp storePDE a (b ! n)) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s b n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (valid_pde_slots'2 (Inr (a, b))) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (storePDE (b ! n) a) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa pde pde_entries a s b n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2988 capa pde pde_entries a s b n) (?Q'2988 capa pde pde_entries a s b n) [] (storePDE (b ! n) a) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))))
 2. \<And>capa pde pde_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pde_slots'2 (Inr (a, b)) sa; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2988 capa pde pde_entries a s b n sa \<and> s' \<in> ?Q'2988 capa pde pde_entries a s b n
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 10. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa pde pde_entries a s b n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2988 capa pde pde_entries a s b n) (?C'2995 capa pde pde_entries a s b n) [] (storePDE (b ! n) a) (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))
 2. \<And>capa pde pde_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pde_slots'2 (Inr (a, b)) sa; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2988 capa pde pde_entries a s b n sa \<and> s' \<in> ?C'2995 capa pde pde_entries a s b n \<inter> \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 10. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pde_slots'2 (Inr (a, b)) sa; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' (b ! n && mask pdBits) \<and> s' \<in> \<lbrace>ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) = b ! n\<rbrace> \<inter> \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> \<inter> \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pde_slots'2 (Inr (a, b)) sa; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> valid_pde_mapping_offset' (b ! n && mask pdBits) \<and> ptr_val (pde_range_C.base_C pde_entries +\<^sub>p int n) = b ! n \<and> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat (word_of_nat n))) (hrs_htd (t_hrs_' (globals s')))) \<and> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (word_of_nat n)) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s n sa s' sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<2 ^ sz]); n < 2 ^ sz; (sa, s') \<in> rf_sr; page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<2 ^ sz]) && ~~ mask pdBits) sa; i_' s' = word_of_nat n; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p int x) && mask pdBits); page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<2 ^ sz]) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<2 ^ sz])) (Suc (Suc sz)); sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat (word_of_nat n))) (hrs_htd (t_hrs_' (globals s')))) \<and> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (word_of_nat n)) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s n sa s' sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<16]); n < 16; (sa, s') \<in> rf_sr; page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<16]) && ~~ mask pdBits) sa; i_' s' = word_of_nat n; \<forall>x\<in>{0..<16}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p int x) && mask pdBits); page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<16]) && ~~ mask pdBits) s; unat (pde_range_C.length_C pde_entries) = 16; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<16])) 6; sz = 4\<rbrakk> \<Longrightarrow> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat (word_of_nat n))) (hrs_htd (t_hrs_' (globals s')))) \<and> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (word_of_nat n)) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s n sa s' sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, ptr_val (pde_range_C.base_C pde_entries) # map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [Suc 0..<16]); n < 16; (sa, s') \<in> rf_sr; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; i_' s' = word_of_nat n; \<forall>x\<in>{0..<16}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p int x) && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; unat (pde_range_C.length_C pde_entries) = 16; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6; sz = 4\<rbrakk> \<Longrightarrow> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat (word_of_nat n))) (hrs_htd (t_hrs_' (globals s')))) \<and> (word_of_nat n = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (word_of_nat n)) (hrs_htd (t_hrs_' (globals s'))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pde pde_entries a s n sa s' sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, ptr_val (pde_range_C.base_C pde_entries) # map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [Suc 0..<16]); n < 16; (sa, s') \<in> rf_sr; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; i_' s' = word_of_nat n; \<forall>x\<in>{0..<16}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p int x) && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; unat (pde_range_C.length_C pde_entries) = 16; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6; sz = 4\<rbrakk> \<Longrightarrow> True \<and> True
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pde_range_C.length_C pde_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 8. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 9. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 10. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pde_range_C.base_C pde_entries +\<^sub>p uint \<acute>i) pde))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 8. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 10. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa pde pde_entries a s b t_hrs i. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s\<rbrakk> \<Longrightarrow> i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat i) (hrs_htd t_hrs) \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t (pde_range_C.base_C pde_entries +\<^sub>p uint i) \<longrightarrow> i = 0 \<or> array_assertion (pde_range_C.base_C pde_entries) (Suc (unat i)) (hrs_htd t_hrs) \<longrightarrow> i = i
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 7. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 8. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 10. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pde_slots'2 mapping\<rbrace> swp storePDE a (b ! n) \<lbrace>\<lambda>_. valid_pde_slots'2 mapping\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 7. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 9. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> length b < 2 ^ word_bits
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; 0 < unat (pde_range_C.length_C pde_entries); valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])) s; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])\<rbrakk> \<Longrightarrow> unat (pde_range_C.length_C pde_entries) < 2 ^ word_bits
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pde pde_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; 0 < unat (pde_range_C.length_C pde_entries); valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])) s; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])\<rbrakk> \<Longrightarrow> unat (pde_range_C.length_C pde_entries) < ?y3059 capa pde pde_entries a s
 2. \<And>capa pde pde_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; 0 < unat (pde_range_C.length_C pde_entries); valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])) s; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])\<rbrakk> \<Longrightarrow> ?y3059 capa pde pde_entries a s \<le> 2 ^ word_bits
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 7. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 9. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; 0 < unat (pde_range_C.length_C pde_entries); valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])) s; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])\<rbrakk> \<Longrightarrow> 2 ^ LENGTH(32) \<le> 2 ^ word_bits
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pde pde_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>?Q2969 capa pde pde_entries a s b xfdc rva tlbflush_required\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pde pde_entries a s b xfdc rva tlbflush_required)
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3216 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?Q3215 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries));;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ?P'3216 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> ?Q3215 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv'})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3216 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?G'3220 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long) [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))} (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,ret__unsigned_long);;
Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ?P'3216 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'3220 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' v}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3369 capa pde pde_entries a s b xfdc rva tlbflush_required uu_) (?C'3368 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long) [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (CALL cleanCacheRange_PoU_'proc(ptr_val (pde_range_C.base_C pde_entries),ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3,ret__unsigned_long);;
(Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and (?A3369 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?C'3368 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3376 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv) (?Q'3376 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc) [SKIP] (do y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (Guard MemorySafety \<lbrace>pde_range_C.length_C pde_entries = 1 \<or> array_assertion (pde_range_C.base_C pde_entries) (unat (pde_range_C.length_C pde_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>?Q3376 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3376 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3419 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv) (?C'3418 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc) [SKIP] (do y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (SKIP;;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. ?A3419 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'3418 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t) \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3419 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?C'3418 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. ?A3419 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?C'3418 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t) \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3440 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?S3443 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (CALL invalidateTLBByASID_'proc(asid);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> ?Q3440 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?S3443 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t)) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3440 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?S3443 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- invalidateTLBByASID asid;
return []
od) (CALL invalidateTLBByASID_'proc(asid);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> ?Q3440 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?S3443 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t)) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3454 capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv) (?Q'3468 capa pde pde_entries a s b xfdca tlbflush_required xfdcb rv xfdc) [SKIP] (return []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3462 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>?Q3454 capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3462 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>ta rvb. dc rvb (xfdc ta) \<longrightarrow> s'\<lparr>globals := globals ta\<rparr> \<in> ?Q'3467 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t) ta rvb}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 7. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 9. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace>
flex-flex pairs:
\<lambda>capa pde pde_entries a s b xfdca tlbflush_required xfdcb t rv. ?Q'3468 capa pde pde_entries a s b xfdca tlbflush_required xfdcb rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa pde pde_entries a s b xfdca tlbflush_required. ?Q'3467 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () proof (prove)
goal (10 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3462 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3462 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 7. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 9. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv xfdc \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3462 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3462 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 6. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 7. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 9. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3462 capa pde pde_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3462 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. True)) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); \<not> rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required = 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3439 capa pde pde_entries a s b xfdca False 0 () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) ()) (?T3441 capa pde pde_entries a s b xfdca False 0 () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) () xfdc) [SKIP] (return []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. True)) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3439 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {sa. (tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sa \<in> ?T3441 capa pde pde_entries a s b xfdca rva tlbflush_required uu_ rv' v rv (xfdc t))} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); \<not> rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required = 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>a. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. True)) a) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); \<not> rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)); tlbflush_required = 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>a. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. True)) a) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pdeBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>a. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. True)) a) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True)) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>uu_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3378 capa pde pde_entries a s b xfdc rva tlbflush_required uu_ and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePDE a) b \<lbrace>\<lambda>_. valid_pde_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> True) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>_. valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>?Q3562 capa pde pde_entries a s b xfdc tlbflush_required\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); ?Q3562 capa pde pde_entries a s b xfdc tlbflush_required rv sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and ?R2973 capa pde pde_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P3569 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>?Q3565 capa pde pde_entries a s b xfdc tlbflush_required\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); ?Q3565 capa pde pde_entries a s b xfdc tlbflush_required rv sa \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. ?P3569 capa pde pde_entries a s b rv xfdc c d \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required x. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> storePDE x a \<lbrace>\<lambda>rv. ?P3570 capa pde pde_entries a s b xfdc tlbflush_required x\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>?P3570 capa pde pde_entries a s b xfdc tlbflush_required y\<rbrace> storePDE x a \<lbrace>\<lambda>rv. ?P3570 capa pde pde_entries a s b xfdc tlbflush_required y\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. ?P3570 capa pde pde_entries a s b xfdc tlbflush_required x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 5. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. True \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required x. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> setObject x a \<lbrace>\<lambda>rv. ?P3570 capa pde pde_entries a s b xfdc tlbflush_required x\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>?P3570 capa pde pde_entries a s b xfdc tlbflush_required y\<rbrace> storePDE x a \<lbrace>\<lambda>rv. ?P3570 capa pde pde_entries a s b xfdc tlbflush_required y\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. ?P3570 capa pde pde_entries a s b xfdc tlbflush_required x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 5. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. True \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required x ko sa xa y n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> updateObject a ko x y n sa = updateObject_default a ko x y n sa
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required x v. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePDE x a \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 5. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 6. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 7. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. True \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 8. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 9. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required x v. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePDE x a \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 4. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 5. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 6. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. True \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 7. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 8. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePDE x a \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. True \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s b x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>pde_at' y\<rbrace> storePDE x a \<lbrace>\<lambda>rv. pde_at' y\<rbrace>
 2. \<And>capa pde pde_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3568 capa pde pde_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (\<lambda>b. storePDE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pde_slots'2 mapping s \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize s\<rbrace>
 3. \<And>capa pde pde_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 mapping sa \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pde_slots'2 (Inr (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) and pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) and page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits))) sa
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pde_slots'2 mapping and (\<lambda>d. True \<and> ?P'3568 capa pde pde_entries a s b rv xfdc c d)\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pde_slots'2 (Inr (a, b)) sa \<and> unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); \<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa; valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> pde_at' (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); \<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa; valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); \<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa; valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (hd b) sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (hd b) sa; obj_at' (\<lambda>a. True) (last b) sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pdeBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pdeBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pdeBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> unat (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pdeBits - 1) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0) \<and> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> ((unat (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pdeBits - 1)) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0)) \<and> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> (unat (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pdeBits - 1)) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0)
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> (unat (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pdeBits - 1)) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pdeBits - 1) - b ! 0)
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s b sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; mapping = Inr (a, b); valid_pde_mappings' sa; page_directory_at' (b ! 0 && ~~ mask pdBits) sa; unat (b ! (2 ^ sz - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (2 ^ sz - Suc 0)) sa; \<forall>x\<in>set b. valid_pde_mapping_offset' (x && mask pdBits); page_directory_at' (b ! 0 && ~~ mask pdBits) s; sz \<le> 4; length b = 2 ^ sz; is_aligned (b ! 0) (Suc (Suc sz)); sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> b ! 0 \<le> b ! (2 ^ sz - Suc 0) + 3 \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (2 ^ sz - Suc 0) + 3 - b ! 0)
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) \<le> ptr_val (pde_range_C.base_C pde_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) \<le> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) + (2 ^ sz * 4 - 1)
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz))\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) \<le> ptr_val (pde_range_C.base_C pde_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) \<le> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) + (2 ^ sz * 4 - 1)
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz))\<rbrakk> \<Longrightarrow> sz + 2 < LENGTH(32)
 2. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) \<le> ptr_val (pde_range_C.base_C pde_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) \<le> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) + (2 ^ sz * 4 - 1)
 3. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 4. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 5. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 6. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 7. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) \<le> ptr_val (pde_range_C.base_C pde_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) \<le> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) + (2 ^ sz * 4 - 1)
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) \<le> ptr_val (pde_range_C.base_C pde_entries) + 2 ^ sz * 4 - 1 \<and> True
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) \<le> ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 1) \<and> True
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (2 ^ sz * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4; is_aligned (addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> True \<and> True
 2. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 3. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 4. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 6. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); valid_pde_mappings' sa; valid_pde_slots'2 (Inr (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1))) sa \<and> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pde pde_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]) && ~~ mask pdBits) sa; unat (pde_range_C.length_C pde_entries * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pde_range_C.base_C pde_entries) + (pde_range_C.length_C pde_entries * 4 - 4)) sa; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz])) (Suc (Suc sz)); sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) sa
 2. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 3. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 5. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pde_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pde_C \<rightarrow> unit) (pde_range_C.base_C pde_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pde_range_C.base_C pde_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pdeBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>} \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<noteq> 0 \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)\<rbrace>}})
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s b sa sb. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); i_' sa = word_of_nat (length b); (sb, sa) \<in> rf_sr; valid_pde_slots'2 (Inr (a, b)) sb\<rbrakk> \<Longrightarrow> ptr_val (pde_range_C.base_C pde_entries) = b ! 0 \<and> 4 + ptr_val (pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1)) = b ! (length b - Suc 0) + 2 ^ pdeBits \<and> addrFromPPtr (ptr_val (pde_range_C.base_C pde_entries)) = addrFromPPtr (b ! 0) \<and> unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> 0 < unat (pde_range_C.length_C pde_entries - 1) \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s sa sb. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; 0 < unat (pde_range_C.length_C pde_entries); valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])) s; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)]); i_' sa = pde_range_C.length_C pde_entries; (sb, sa) \<in> rf_sr; valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_range_C.base_C pde_entries +\<^sub>p int x)) [0..<unat (pde_range_C.length_C pde_entries)])) sb\<rbrakk> \<Longrightarrow> pde_range_C.base_C pde_entries +\<^sub>p uint (pde_range_C.length_C pde_entries - 1) = pde_range_C.base_C pde_entries +\<^sub>p (uint (pde_range_C.length_C pde_entries) - 1) \<and> unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> 0 < unat (pde_range_C.length_C pde_entries - 1) \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s sa sb. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; 0 < unat (pde_range_C.length_C pde_entries); valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<unat (pde_range_C.length_C pde_entries)])) s; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<unat (pde_range_C.length_C pde_entries)]); i_' sa = pde_range_C.length_C pde_entries; (sb, sa) \<in> rf_sr; valid_pde_slots'2 (Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<unat (pde_range_C.length_C pde_entries)])) sb\<rbrakk> \<Longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> 0 < unat (pde_range_C.length_C pde_entries - 1) \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s sa sb sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; 1 \<le> pde_range_C.length_C pde_entries; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); i_' sa = pde_range_C.length_C pde_entries; (sb, sa) \<in> rf_sr; page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]) && ~~ mask pdBits) sb; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz])) (Suc (Suc sz)); sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> unat (pde_range_C.length_C pde_entries - 1) \<le> 16 \<and> (pde_range_C.length_C pde_entries \<noteq> 1 \<longrightarrow> 0 < unat (pde_range_C.length_C pde_entries - 1) \<and> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6)
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pde pde_entries a s sa sb sz. \<lbrakk>unat asid \<le> unat (mask local.asid_bits); ccap_relation cap capa; cpde_relation a pde; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<16]); unat (i_' sa) = 16; (sb, sa) \<in> rf_sr; page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<16]) && ~~ mask pdBits) sb; \<forall>x\<in>{0..<16}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<16]) && ~~ mask pdBits) s; unat (pde_range_C.length_C pde_entries) = 16; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<16])) 6; sz = 4\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (pde_range_C.base_C pde_entries)) 6
 2. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 4. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>capa pde pde_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pde pde_entries a s b rv\<rbrace> pdeCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pde_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 2. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pde pde_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pde pde_entries a s b c\<rbrace>
 3. \<And>capa pde pde_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pde___ptr_to_struct_pde_C_' := pde_range_C.base_C pde_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pde___ptr_to_struct_pde_C = pde_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pde_range_C.length_C pde_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pde_range_C.length_C pde_entries \<le> 0x10\<rbrace>}}
 4. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pde pde_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>capa pde pde_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; pde_range_relation b pde_entries; b \<noteq> []; valid_pde_slots'2 (Inr (a, b)) s; mapping = Inr (a, b)\<rbrakk> \<Longrightarrow> pde_range_C.base_C pde_entries = pde_Ptr (hd b) \<and> pde_range_C.length_C pde_entries \<le> 0x10
 2. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> valid_pde_slots'2 mapping a \<and> True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>asida ctSlot capa pde pde_entries s s'. \<lbrakk>asid \<le> mask local.asid_bits; isRight mapping; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpde_relation (fst (theRight mapping)) pde; pde_range_relation (snd (theRight mapping)) pde_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pde_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> valid_pde_slots'2 mapping a \<and> True \<and> valid_pde_mappings' a \<and> valid_pde_slots'2 mapping a \<and> unat (last (snd (theRight mapping)) + 3 - hd (snd (theRight mapping))) \<le> gsMaxObjectSize a) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theRight mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pde_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>capa pde pde_entries s s' a sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpde_relation a pde; (s, s') \<in> rf_sr; mapping = Inr (a, map (ptr_val \<circ> (\<lambda>x. pde_Ptr (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); invs' s; cte_wp_at' (\<lambda>_. True) slot s; 63 \<le> gsMaxObjectSize s; \<forall>x\<in>{0..<2 ^ sz}. valid_pde_mapping_offset' (ptr_val (pde_range_C.base_C pde_entries) + word_of_nat x * 4 && mask pdBits); page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits) s; sz \<le> 4; unat (pde_range_C.length_C pde_entries) = 2 ^ sz; is_aligned (ptr_val (pde_range_C.base_C pde_entries)) (Suc (Suc sz)); sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> valid_pde_mappings' s \<and> unat (pde_range_C.length_C pde_entries * 4 - 1) \<le> gsMaxObjectSize s \<and> Ex (page_directory_at' (ptr_val (pde_range_C.base_C pde_entries) && ~~ mask pdBits)) proof (prove)
goal:
No subgoals!