theory ArchUserOp_IF

lemma ptable_rights_data_consistant:
  assumes vs: "valid_state s"
  and vpdpt: "valid_pdpt_objs s"
  and pt_lift: "ptable_lift t s x = Some ptr"
  and dat: "data_at sz ((ptrFromPAddr ptr) && ~~ mask (pageBitsForSize sz)) s"
  and misc: "get_pd_of_thread (kheap s) (arch_state s) t \<noteq>
             arm_global_pd (arch_state s)" "x \<notin> kernel_mappings"
  shows "ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x" proof - have aligned_stuff:
    "is_aligned (ucast ((x >> 12) && mask 8) :: word8) 4 \<Longrightarrow> (x && ~~ mask 16 >> 12) = x >> 12" by (simp add: is_aligned_mask mask_def) word_bitwise have aligned_stuff':
    "is_aligned ((ucast (x >> 20)):: 12 word) 4 \<Longrightarrow> x && ~~ mask 24 >> 20 = x >> 20" by (simp add: is_aligned_mask mask_def) word_bitwise have vs': "valid_objs s \<and> valid_vspace_objs s \<and> pspace_distinct s \<and> pspace_aligned s" using vs by (simp add: valid_state_def valid_pspace_def) have x_less_kb: "x < kernel_base" using misc by (simp add: kernel_mappings_def)  (* FIXME: any rules exists already ? *)
   thus ?thesis using pt_lift dat vs' apply (clarsimp simp: ptable_rights_def ptable_lift_def split: option.splits) apply (clarsimp simp: get_page_info_def split: option.splits) apply (rename_tac base sz' attrs rights pde) apply (case_tac pde, simp_all) apply (clarsimp simp: get_pd_entry_def split: arch_kernel_obj.split_asm option.splits) apply (clarsimp simp: get_pt_info_def get_arch_obj_def get_pt_entry_def
                     split: option.splits arch_kernel_obj.split_asm kernel_object.splits) apply (rename_tac pd_base vmattr mw pd pt) apply (cut_tac get_pd_of_thread_reachable[OF misc(1)]) apply (frule (1) valid_vspace_objsD2[rotated,unfolded obj_at_def,simplified],simp) apply simp apply (drule bspec) apply (rule Compl_iff[THEN iffD2]) apply (rule kernel_mappings_kernel_mapping_slots[OF misc(2)]) apply (clarsimp simp: valid_pde_def obj_at_def a_type_def) apply (case_tac "pt (ucast ((x >> 12) && mask 8))",simp_all) apply (frule valid_vspace_objsD2[where p = "ptrFromPAddr p" for p,
                                        rotated,unfolded obj_at_def,simplified], simp) apply (rule exI) apply (erule vs_lookup_step) apply (simp add: vs_lookup1_def lookup_pd_slot_def Let_def
                         pd_shifting pd_shifting_dual obj_at_def) apply (rule_tac x = "VSRef (x>>20) (Some APageDirectory)" in exI) apply (rule context_conjI,simp) apply (erule vs_refs_pdI) apply (rule kernel_mappings_kernel_mapping_slots[OF misc(2)]) apply (intro allI impI) apply (simp add: nth_shiftr) apply (rule bang_big[simplified]) apply (simp add: word_size) apply (frule (1) valid_pdpt_align_ptD[OF _ vpdpt]) apply simp apply (drule_tac x="(ucast ((x >> 12) && mask 8))" in spec) apply (frule data_at_same_size[where sz=sz and sz'=ARMLargePage,rotated,simplified], simp+) apply (clarsimp simp: mask_shift_le get_pt_info_def get_pt_entry_def
                             get_arch_obj_def entries_align_def aligned_stuff mask_AND_NOT_mask
                      dest!: data_at_aligned is_aligned_ptrFromPAddrD[where a=16,simplified]) apply (frule valid_vspace_objsD2[where p = "ptrFromPAddr p" for p,
                                       rotated,unfolded obj_at_def,simplified], simp) apply (rule exI) apply (erule vs_lookup_step) apply (simp add: vs_lookup1_def lookup_pd_slot_def Let_def
                        pd_shifting pd_shifting_dual obj_at_def) apply (rule_tac x = "VSRef (x>>20) (Some APageDirectory)" in exI) apply (rule context_conjI,simp) apply (erule vs_refs_pdI) apply (rule kernel_mappings_kernel_mapping_slots[OF misc(2)]) apply (intro allI impI) apply (simp add: nth_shiftr) apply (rule bang_big[simplified]) apply (simp add: word_size) apply (frule(1) valid_pdpt_align_ptD[OF _ vpdpt]) apply simp apply (drule_tac x="(ucast ((x >> 12) && mask 8))" in spec) apply (frule data_at_same_size[where sz=sz and sz'=ARMSmallPage,rotated,simplified], simp+) apply (clarsimp simp: mask_shift_le get_pt_info_def get_pt_entry_def get_arch_obj_def
                     dest!: data_at_aligned is_aligned_ptrFromPAddrD[where a=12,simplified]) apply (clarsimp simp: get_pd_entry_def get_arch_obj_def
                    split: arch_kernel_obj.split_asm option.splits) apply (clarsimp simp: get_pt_entry_def
                    split: option.splits arch_kernel_obj.split_asm kernel_object.splits) apply (rename_tac pd_base vmattr mw pd caprights) apply (cut_tac get_pd_of_thread_reachable[OF misc(1)]) apply (frule(1) valid_vspace_objsD2[rotated,unfolded obj_at_def,simplified],simp) apply simp apply (drule bspec) apply (rule Compl_iff[THEN iffD2]) apply (rule kernel_mappings_kernel_mapping_slots[OF misc(2)]) apply (clarsimp simp: valid_pde_def obj_at_def) apply (frule(1) valid_pdpt_align_pdD[OF _ vpdpt]) apply (frule data_at_same_size[where sz = sz and sz' = ARMSection,rotated,simplified],
          clarsimp+) apply (clarsimp simp: get_pd_entry_def get_arch_obj_def
                   split: arch_kernel_obj.split_asm option.splits) apply (clarsimp simp: get_pt_entry_def
                   split: option.splits arch_kernel_obj.split_asm kernel_object.splits) apply (rename_tac pd_base vmattr rights pd) apply (cut_tac get_pd_of_thread_reachable[OF misc(1)]) apply (frule (1) valid_vspace_objsD2[rotated,unfolded obj_at_def,simplified],simp) apply simp apply (drule bspec) apply (rule Compl_iff[THEN iffD2]) apply (rule kernel_mappings_kernel_mapping_slots[OF misc(2)]) apply (clarsimp simp: valid_pde_def obj_at_def) apply (frule(1) valid_pdpt_align_pdD[OF _ vpdpt]) apply (frule data_at_same_size[where sz=sz and sz'=ARMSuperSection,rotated,simplified], simp+) apply (clarsimp simp: aligned_stuff' neg_mask_add_aligned[OF _ and_mask_less'] mask_AND_NOT_mask
                   dest!: data_at_aligned is_aligned_ptrFromPAddrD[where a = 24,simplified]) done qed

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (state)
goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
goal (1 subgoal):
 1. is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) 4 \<Longrightarrow> x && ~~ mask 16 >> 12 = x >> 12 proof (state)
this:
is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) 4 \<Longrightarrow> x && ~~ mask 16 >> 12 = x >> 12

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
goal (1 subgoal):
 1. is_aligned (UCAST(32 \<rightarrow> 12) (x >> 20)) 4 \<Longrightarrow> x && ~~ mask 24 >> 20 = x >> 20 proof (state)
this:
is_aligned (UCAST(32 \<rightarrow> 12) (x >> 20)) 4 \<Longrightarrow> x && ~~ mask 24 >> 20 = x >> 20

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
goal (1 subgoal):
 1. valid_objs s \<and> valid_vspace_objs s \<and> pspace_distinct s \<and> pspace_aligned s proof (prove)
using this:
valid_state s

goal (1 subgoal):
 1. valid_objs s \<and> valid_vspace_objs s \<and> pspace_distinct s \<and> pspace_aligned s proof (state)
this:
valid_objs s \<and> valid_vspace_objs s \<and> pspace_distinct s \<and> pspace_aligned s

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
goal (1 subgoal):
 1. x < kernel_base proof (prove)
using this:
get_pd_of_thread (kheap s) (arch_state s) t \<noteq> arm_global_pd (arch_state s)
x \<notin> kernel_mappings

goal (1 subgoal):
 1. x < kernel_base proof (state)
this:
x < kernel_base

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (state)
this:
x < kernel_base

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
using this:
x < kernel_base

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
using this:
x < kernel_base
ptable_lift t s x = Some ptr
data_at sz (ptrFromPAddr ptr && ~~ mask (pageBitsForSize sz)) s
valid_objs s \<and> valid_vspace_objs s \<and> pspace_distinct s \<and> pspace_aligned s

goal (1 subgoal):
 1. ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab b. \<lbrakk>data_at sz (ptrFromPAddr (a + (x && mask aa)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_page_info (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (a, aa, ab, b); ptr = a + (x && mask aa)\<rbrakk> \<Longrightarrow> (get_page_info (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = b) \<and> (\<forall>a aa ab ba. get_page_info (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some (a, aa, ab, ba) \<longrightarrow> ba = b) proof (prove)
goal (1 subgoal):
 1. \<And>a aa ab b x2. \<lbrakk>ptr = a + (x && mask aa); data_at sz (ptrFromPAddr (a + (x && mask aa)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some x2; (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) x | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b)\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = b) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = b) \<and> (\<forall>a aa ab ba. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, ba) \<longrightarrow> ba = b)) proof (prove)
goal (1 subgoal):
 1. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some pde; (case pde of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) x | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (base, sz', attrs, rights)\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pde x21 x22 x23. \<lbrakk>ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (PageTablePDE x21 x22 x23); get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr x21) x = Some (base, sz', attrs, rights); pde = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights x21 x22 x23 x3. \<lbrakk>get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr x21) x = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_arch_obj (kheap s (get_pd_of_thread (kheap s) (arch_state s) t)) = Some (PageDirectory x3); x3 (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> ((case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights x21 x22 x23 x3 x2d. \<lbrakk>(case x2d (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory x3)); x3 (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE x21 x22 x23; kheap s (ptrFromPAddr x21) = Some (ArchObj (PageTable x2d))\<rbrakk> \<Longrightarrow> ((case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt))\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_vspace_obj (PageDirectory pd) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ?x232 base sz' attrs rights pd_base vmattr mw pd pt \<in> - kernel_mapping_slots
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (pd (?x232 base sz' attrs rights pd_base vmattr mw pd pt)) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ?x232 base sz' attrs rights pd_base vmattr mw pd pt \<notin> kernel_mapping_slots
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (pd (?x232 base sz' attrs rights pd_base vmattr mw pd pt)) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (pd (UCAST(32 \<rightarrow> 12) (x >> 20))) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>(case pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) of InvalidPTE \<Rightarrow> None | LargePagePTE base attrs rights \<Rightarrow> Some (base, 16, attrs, rights) | SmallPagePTE base attrs rights \<Rightarrow> Some (base, 12, attrs, rights)) = Some (base, sz', attrs, rights); ptr = base + (x && mask sz'); data_at sz (ptrFromPAddr (base + (x && mask sz')) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> ptrFromPAddr pd_base) s
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights\<rbrakk> \<Longrightarrow> (?ref247 base sz' attrs rights pd_base vmattr mw pd pt ref \<rhd> ptrFromPAddr pd_base) s
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((ref, get_pd_of_thread (kheap s) (arch_state s) t), ?ref247 base sz' attrs rights pd_base vmattr mw pd pt ref, ptrFromPAddr pd_base) \<in> vs_lookup1 s
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights\<rbrakk> \<Longrightarrow> \<exists>r. ?ref247 base 16 attrs rights pd_base vmattr mw pd pt ref = r # ref \<and> (r, ptrFromPAddr pd_base) \<in> vs_refs (ArchObj (PageDirectory pd))
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights\<rbrakk> \<Longrightarrow> ?ref247 base 16 attrs rights pd_base vmattr mw pd pt ref = VSRef (x >> 20) (Some APageDirectory) # ref \<and> (VSRef (x >> 20) (Some APageDirectory), ptrFromPAddr pd_base) \<in> vs_refs (ArchObj (PageDirectory pd))
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> (VSRef (x >> 20) (Some APageDirectory), ptrFromPAddr pd_base) \<in> vs_refs (ArchObj (PageDirectory pd))
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (6 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (x >> 20) \<notin> kernel_mapping_slots
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> \<forall>n\<ge>12. n < 32 \<longrightarrow> \<not> (x >> 20) !! n
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 5. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 6. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> \<forall>n\<ge>12. n < 32 \<longrightarrow> \<not> (x >> 20) !! n
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref n. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref; 12 \<le> n; n < 32\<rbrakk> \<Longrightarrow> \<not> (x >> 20) !! n
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base pd pt n. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; 12 \<le> n; n < 32\<rbrakk> \<Longrightarrow> \<not> x !! (20 + n)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base pd pt n. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; 12 \<le> n; n < 32\<rbrakk> \<Longrightarrow> size x \<le> 20 + n
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; valid_vspace_obj (PageTable pt) s; is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) (pte_range_sz (LargePagePTE base attrs rights))\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; \<forall>x. valid_pte (pt x) s; is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) 4\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at sz (ptrFromPAddr (base + (x && mask 16)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) 4; valid_pte (pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8))) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 16; ptr = base + (x && mask 16); data_at ARMLargePage (ptrFromPAddr (base + (x && mask 16)) && ~~ mask 16) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = LargePagePTE base attrs rights; is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) 4; data_at ARMLargePage (ptrFromPAddr base) s; ARMLargePage = sz\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 16 >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 16 >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> ptrFromPAddr pd_base) s
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> (?ref281 base sz' attrs rights pd_base vmattr mw pd pt ref \<rhd> ptrFromPAddr pd_base) s
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ((ref, get_pd_of_thread (kheap s) (arch_state s) t), ?ref281 base sz' attrs rights pd_base vmattr mw pd pt ref, ptrFromPAddr pd_base) \<in> vs_lookup1 s
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> \<exists>r. ?ref281 base 12 attrs rights pd_base vmattr mw pd pt ref = r # ref \<and> (r, ptrFromPAddr pd_base) \<in> vs_refs (ArchObj (PageDirectory pd))
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights\<rbrakk> \<Longrightarrow> ?ref281 base 12 attrs rights pd_base vmattr mw pd pt ref = VSRef (x >> 20) (Some APageDirectory) # ref \<and> (VSRef (x >> 20) (Some APageDirectory), ptrFromPAddr pd_base) \<in> vs_refs (ArchObj (PageDirectory pd))
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> (VSRef (x >> 20) (Some APageDirectory), ptrFromPAddr pd_base) \<in> vs_refs (ArchObj (PageDirectory pd))
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (5 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (x >> 20) \<notin> kernel_mapping_slots
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> \<forall>n\<ge>12. n < 32 \<longrightarrow> \<not> (x >> 20) !! n
 3. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 4. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 5. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref\<rbrakk> \<Longrightarrow> \<forall>n\<ge>12. n < 32 \<longrightarrow> \<not> (x >> 20) !! n
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref n. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; VSRef (x >> 20) (Some APageDirectory) # ref = VSRef (x >> 20) (Some APageDirectory) # ref; 12 \<le> n; n < 32\<rbrakk> \<Longrightarrow> \<not> (x >> 20) !! n
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base pd pt n. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; 12 \<le> n; n < 32\<rbrakk> \<Longrightarrow> \<not> x !! (20 + n)
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (4 subgoals):
 1. \<And>base sz' attrs rights pd_base pd pt n. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; 12 \<le> n; n < 32\<rbrakk> \<Longrightarrow> size x \<le> 20 + n
 2. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 3. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 4. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_vspace_obj (PageTable pt) s; is_aligned (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) (pte_range_sz (SmallPagePTE base attrs rights))\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; \<forall>x. valid_pte (pt x) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at sz (ptrFromPAddr (base + (x && mask 12)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; valid_pte (pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8))) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>base sz' attrs rights pd_base vmattr mw pd pt ref. \<lbrakk>sz' = 12; ptr = base + (x && mask 12); data_at ARMSmallPage (ptrFromPAddr (base + (x && mask 12)) && ~~ mask 12) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = PageTablePDE pd_base vmattr mw; kheap s (ptrFromPAddr pd_base) = Some (ArchObj (PageTable pt)); (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; pt (UCAST(32 \<rightarrow> 8) ((x >> 12) && mask 8)) = SmallPagePTE base attrs rights; data_at ARMSmallPage (ptrFromPAddr base) s; ARMSmallPage = sz\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 12 >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 12 >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>base sz' attrs rights pde x33. \<lbrakk>ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SectionPDE base attrs x33 rights); sz' = 20; pde = SectionPDE base attrs x33 rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights))
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>base attrs rights x33 x3 x2a. \<lbrakk>x3 (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE base attrs x33 rights; ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some x2a; (case x2a of ArchObj x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some (PageDirectory x3)\<rbrakk> \<Longrightarrow> ((case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>base attrs rights x33 x3. \<lbrakk>x3 (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE base attrs x33 rights; ptr = base + (x && mask 20); data_at sz (ptrFromPAddr (base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ((case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights))\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_vspace_obj (PageDirectory caprights) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; \<forall>x\<in>- kernel_mapping_slots. valid_pde (caprights x) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ?x406 pd_base vmattr mw pd caprights \<in> - kernel_mapping_slots
 2. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (caprights (?x406 pd_base vmattr mw pd caprights)) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (3 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ?x406 pd_base vmattr mw pd caprights \<notin> kernel_mapping_slots
 2. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (caprights (?x406 pd_base vmattr mw pd caprights)) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 3. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (caprights (UCAST(32 \<rightarrow> 12) (x >> 20))) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights ref. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); data_at ARMSection (ptrFromPAddr pd_base) s; (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr mw pd caprights ref. \<lbrakk>caprights (UCAST(32 \<rightarrow> 12) (x >> 20)) = SectionPDE pd_base vmattr pd mw; ptr = pd_base + (x && mask 20); data_at sz (ptrFromPAddr (pd_base + (x && mask 20)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory caprights)); data_at ARMSection (ptrFromPAddr pd_base) s; (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; is_aligned (UCAST(32 \<rightarrow> 12) (x >> 20)) (pde_range_sz (SectionPDE pd_base vmattr pd mw))\<rbrakk> \<Longrightarrow> ((case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = mw) \<and> (\<forall>a aa ab b. (case caprights (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = mw)
 2. \<And>base sz' attrs rights pde. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights); sz' = 24; pde = SuperSectionPDE base attrs rights\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (1 subgoal):
 1. \<And>base attrs rights. \<lbrakk>ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) x = Some (SuperSectionPDE base attrs rights)\<rbrakk> \<Longrightarrow> (get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = None \<longrightarrow> {} = rights) \<and> (\<forall>x2. get_pd_entry (\<lambda>obj. get_arch_obj (kheap s obj)) (get_pd_of_thread (kheap s) (arch_state s) t) (x && ~~ mask (pageBitsForSize sz)) = Some x2 \<longrightarrow> ((case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x2 of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights)) proof (prove)
goal (1 subgoal):
 1. \<And>base attrs rights x3 x2a. \<lbrakk>x3 (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE base attrs rights; ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some x2a; (case x2a of ArchObj x \<Rightarrow> Some x | _ \<Rightarrow> None) = Some (PageDirectory x3)\<rbrakk> \<Longrightarrow> ((case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>base attrs rights x3. \<lbrakk>x3 (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE base attrs rights; ptr = base + (x && mask 24); data_at sz (ptrFromPAddr (base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ((case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case x3 (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd))\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_vspace_obj (PageDirectory pd) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; \<forall>x\<in>- kernel_mapping_slots. valid_pde (pd x) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ?x516 pd_base vmattr rights pd \<in> - kernel_mapping_slots
 2. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (pd (?x516 pd_base vmattr rights pd)) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (2 subgoals):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ?x516 pd_base vmattr rights pd \<notin> kernel_mapping_slots
 2. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (pd (?x516 pd_base vmattr rights pd)) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); \<exists>ref. (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; valid_pde (pd (UCAST(32 \<rightarrow> 12) (x >> 20))) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd ref. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); data_at ARMSuperSection (ptrFromPAddr pd_base) s; (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd ref. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at sz (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask (pageBitsForSize sz)) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); data_at ARMSuperSection (ptrFromPAddr pd_base) s; (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; is_aligned (UCAST(32 \<rightarrow> 12) (x >> 20)) (pde_range_sz (SuperSectionPDE pd_base vmattr rights))\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask (pageBitsForSize sz) >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal (1 subgoal):
 1. \<And>pd_base vmattr rights pd ref. \<lbrakk>pd (UCAST(32 \<rightarrow> 12) (x >> 20)) = SuperSectionPDE pd_base vmattr rights; ptr = pd_base + (x && mask 24); data_at ARMSuperSection (ptrFromPAddr (pd_base + (x && mask 24)) && ~~ mask 24) s; x < kernel_base; valid_objs s; valid_vspace_objs s; pspace_distinct s; pspace_aligned s; kheap s (get_pd_of_thread (kheap s) (arch_state s) t) = Some (ArchObj (PageDirectory pd)); data_at ARMSuperSection (ptrFromPAddr pd_base) s; (ref \<rhd> get_pd_of_thread (kheap s) (arch_state s) t) s; is_aligned (UCAST(32 \<rightarrow> 12) (x >> 20)) 4; ARMSuperSection = sz\<rbrakk> \<Longrightarrow> ((case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 24 >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = None \<longrightarrow> {} = rights) \<and> (\<forall>a aa ab b. (case pd (UCAST(32 \<rightarrow> 12) (x && ~~ mask 24 >> 20)) of InvalidPDE \<Rightarrow> None | PageTablePDE p xa xaa \<Rightarrow> get_pt_info (\<lambda>obj. get_arch_obj (kheap s obj)) (ptrFromPAddr p) (x && ~~ mask (pageBitsForSize sz)) | SectionPDE base attrs x rights \<Rightarrow> Some (base, 20, attrs, rights) | SuperSectionPDE base attrs rights \<Rightarrow> Some (base, 24, attrs, rights)) = Some (a, aa, ab, b) \<longrightarrow> b = rights) proof (prove)
goal:
No subgoals! proof (state)
this:
ptable_rights t s (x && ~~ mask (pageBitsForSize sz)) = ptable_rights t s x

goal:
No subgoals!