theory Arch_DR

lemma invoke_page_table_corres:
  "transform_page_table_inv ptinv' = Some ptinv \<Longrightarrow>
   dcorres dc \<top> (valid_pti ptinv' and invs and valid_etcbs)
    (invoke_page_table ptinv) (perform_page_table_invocation ptinv')" apply (simp add: invoke_page_table_def perform_page_table_invocation_def) apply (clarsimp simp: transform_page_table_inv_def
            split: ARM_A.page_table_invocation.split_asm
                   if_split_asm) apply (rename_tac word oref attribs) apply (clarsimp simp: is_pt_cap_def valid_pti_def make_arch_duplicate_def) apply (rule stronger_corres_guard_imp) apply (rule corres_split) apply (rule set_cap_corres; simp) apply (rule corres_split_noop_rhs2) apply (simp add:insert_cap_orphan_def) apply (rule corres_add_noop_rhs) apply (rule corres_split[OF gets_the_noop_dcorres]) apply (rule corres_assert_lhs) apply (rule_tac F ="ucast (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots" in corres_gen_asm2) apply (rule store_pde_set_cap_corres) apply (simp add:transform_pde_def addrFromPPtr_def)+ apply (wp | clarsimp simp: ptrFromPAddr_def)+ apply (rule dcorres_machine_op_noop) apply (wp set_cap_opt_cap)+ apply (clarsimp simp: empty_pde_at_def) apply (frule pde_opt_cap_eq, clarsimp+) apply (clarsimp simp:transform_pde_def kernel_pde_mask_def pde_at_def
                         transform_pd_slot_ref_def transform_cslot_ptr_def) apply (drule page_directory_not_in_cdt, simp+) apply (clarsimp simp: cte_wp_at_caps_of_state is_arch_update_def
                         cap_master_cap_simps
                  dest!: cap_master_cap_eqDs) apply (clarsimp simp: invs_valid_idle not_idle_thread_def) apply (intro conjI) apply (rule ccontr) apply (clarsimp) apply (drule valid_idle_has_null_cap[rotated -1]) apply (clarsimp simp:invs_def valid_state_def)+ apply (clarsimp simp:kernel_vsrefs_kernel_mapping_slots) apply (clarsimp simp: get_pt_mapped_addr_def bind_assoc) apply (rule dcorres_expand_pfx) apply (clarsimp simp:valid_pti_def transform_mapping_def is_pt_cap_def) apply (case_tac asid) apply (clarsimp simp: liftM_def) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule_tac P="\<lambda>y s. cte_wp_at ((=) x) (a,b) s \<and> s = s'" in set_cap_corres_stronger) apply clarsimp apply (drule cte_wp_at_eqD2, simp) apply (clarsimp simp: transform_mapping_def update_map_data_def) apply (wp get_cap_cte_wp_at_rv | clarsimp)+ apply (clarsimp simp:cte_wp_at_def is_arch_cap_def is_pt_cap_def) apply (clarsimp simp:invs_def valid_state_def not_idle_thread_def) apply (frule valid_idle_has_null_cap,simp+) apply (rule sym) apply (simp add:get_cap_caps_of_state)+ apply (clarsimp simp:bind_assoc liftM_def) apply (rule corres_guard_imp) apply (rule corres_split) apply (rule dcorres_unmap_page_table;
              clarsimp simp: valid_cap_def vmsz_aligned_def mask_2pm1) apply (rule_tac a2 = a and b2 = b and option2 = "Some (aa,ba)" in
                 corres_split[OF corres_alternate1[OF dcorres_clear_object_caps_pt]]) apply (rule dcorres_symb_exec_r) apply (rule corres_split) apply (rule get_cap_corres; simp) apply (rule_tac P="\<lambda>y s. cte_wp_at ((=) xb) (a,b) s \<and>
                                caps_of_state s' = caps_of_state s" in set_cap_corres_stronger) apply (clarsimp simp:cte_wp_at_caps_of_state) apply (clarsimp simp: transform_mapping_def update_map_data_def) apply (wp get_cap_cte_wp_at_rv | clarsimp)+ apply (wp do_machine_op_wp | clarsimp simp:not_idle_thread_def)+ apply (wp mapM_x_wp) apply clarsimp apply (wp store_pte_cte_wp_at) apply fastforce apply wpsimp+ apply (rule_tac Q="\<lambda>rv s. invs s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at \<top> (a,b) s \<and>
                              caps_of_state s' = caps_of_state s" in hoare_strengthen_post) apply wp apply (clarsimp simp:invs_def valid_state_def) apply simp apply (simp add:valid_cap_def vmsz_aligned_def mask_2pm1) apply (simp add:cte_wp_at_def transform_cap_def update_map_data_def transform_mapping_def
                  is_arch_cap_def mask_cap_def cap_rights_update_def is_pt_cap_def cap_aligned_def) apply (rule ccontr,clarsimp simp:invs_def valid_state_def) apply (drule valid_idle_has_null_cap,simp+) apply (clarsimp simp:get_cap_caps_of_state) apply (rule sym, simp+) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. transform_page_table_inv ptinv' = Some ptinv \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti ptinv' and invs and valid_etcbs) (invoke_page_table ptinv) (perform_page_table_invocation ptinv') proof (prove)
goal (1 subgoal):
 1. transform_page_table_inv ptinv' = Some ptinv \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti ptinv' and invs and valid_etcbs) (case ptinv of cdl_page_table_invocation.PageTableMap real_pt_cap pt_cap pt_cap_ref pd_target_slot \<Rightarrow> do KHeap_D.set_cap pt_cap_ref real_pt_cap;
insert_cap_orphan pt_cap pd_target_slot
od | cdl_page_table_invocation.PageTableUnmap mapped_addr pt_id pt_cap_ref \<Rightarrow> do case mapped_addr of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr pt_id;
clear_object_caps pt_id \<sqinter> return ()
od;
cap <- KHeap_D.get_cap pt_cap_ref;
KHeap_D.set_cap pt_cap_ref (reset_mem_mapping cap)
od) (case ptinv' of page_table_invocation.PageTableMap cap ct_slot pde pd_slot \<Rightarrow> do CSpaceAcc_A.set_cap cap ct_slot;
store_pde pd_slot pde;
do_machine_op $ cleanByVA_PoU pd_slot (addrFromPPtr pd_slot)
od | page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p mapped_address)) ct_slot \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap ct_slot;
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) ct_slot
od | page_table_invocation.PageTableUnmap (ArchObjectCap _) ct_slot \<Rightarrow> fail | page_table_invocation.PageTableUnmap _ ct_slot \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>x11 a b x14 oref attribs. \<lbrakk>ptinv' = page_table_invocation.PageTableMap x11 (a, b) (PageTablePDE (addrFromPPtr oref) attribs 0) x14; local.is_pt_cap x11; oref \<in> obj_refs x11; ptinv = cdl_page_table_invocation.PageTableMap (transform_cap x11) (make_arch_duplicate (transform_cap x11)) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref x14)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableMap x11 (a, b) (PageTablePDE (addrFromPPtr oref) attribs 0) x14) and invs and valid_etcbs) (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap x11);
insert_cap_orphan (make_arch_duplicate (transform_cap x11)) (transform_pd_slot_ref x14)
od) (do y <- CSpaceAcc_A.set_cap x11 (a, b);
y <- store_pde x14 (PageTablePDE (addrFromPPtr oref) attribs 0);
do_machine_op (cleanByVA_PoU x14 (addrFromPPtr x14))
od)
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>x11 a b word oref attribs. \<lbrakk>ptinv' = page_table_invocation.PageTableMap x11 (a, b) (PageTablePDE (addrFromPPtr oref) attribs 0) word; local.is_pt_cap x11; oref \<in> obj_refs x11; ptinv = cdl_page_table_invocation.PageTableMap (transform_cap x11) (make_arch_duplicate (transform_cap x11)) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableMap x11 (a, b) (PageTablePDE (addrFromPPtr oref) attribs 0) word) and invs and valid_etcbs) (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (transform_cap x11);
insert_cap_orphan (make_arch_duplicate (transform_cap x11)) (transform_pd_slot_ref word)
od) (do y <- CSpaceAcc_A.set_cap x11 (a, b);
y <- store_pde word (PageTablePDE (addrFromPPtr oref) attribs 0);
do_machine_op (cleanByVA_PoU word (addrFromPPtr word))
od)
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid));
insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word)
od) (do y <- CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b);
y <- store_pde word (PageTablePDE (addrFromPPtr p) attribs 0);
do_machine_op (cleanByVA_PoU word (addrFromPPtr word))
od)
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (4 subgoals):
 1. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres dc (?Q49 a b word attribs p asid) (?Q'49 a b word attribs p asid) (do y <- KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid));
insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word)
od) (do y <- CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b);
y <- store_pde word (PageTablePDE (addrFromPPtr p) attribs 0);
do_machine_op (cleanByVA_PoU word (addrFromPPtr word))
od)
 2. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?Q49 a b word attribs p asid s
 3. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ?Q'49 a b word attribs p asid s'
 4. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (7 subgoals):
 1. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres (?r'53 a b word attribs p asid) (?P53 a b word attribs p asid) (?P'53 a b word attribs p asid) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid))) (CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b))
 2. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); ?r'53 a b word attribs p asid y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R53 a b word attribs p asid y) (?R'53 a b word attribs p asid ya) (insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word)) (do y <- store_pde word (PageTablePDE (addrFromPPtr p) attribs 0);
do_machine_op (cleanByVA_PoU word (addrFromPPtr word))
od)
 3. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>?R53 a b word attribs p asid\<rbrace>
 4. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>?R'53 a b word attribs p asid\<rbrace>
 5. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (?P53 a b word attribs p asid and ?Q53 a b word attribs p asid) s
 6. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> (?P'53 a b word attribs p asid and ?Q'53 a b word attribs p asid) s'
 7. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (6 subgoals):
 1. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R53 a b word attribs p asid y) (?R'53 a b word attribs p asid ya) (insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word)) (do y <- store_pde word (PageTablePDE (addrFromPPtr p) attribs 0);
do_machine_op (cleanByVA_PoU word (addrFromPPtr word))
od)
 2. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>?R53 a b word attribs p asid\<rbrace>
 3. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>?R'53 a b word attribs p asid\<rbrace>
 4. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 5. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
 6. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (9 subgoals):
 1. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?P68 a b word attribs p asid y) (?P'70 a b word attribs p asid ya) (insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word)) (store_pde word (PageTablePDE (addrFromPPtr p) attribs 0))
 2. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 3. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 4. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 5. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. ?P68 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 6. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. ?P'70 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 7. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 8. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
 9. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (9 subgoals):
 1. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres dc (?P68 a b word attribs p asid ()) (?P'70 a b word attribs p asid ()) (do old_cap <- KHeap_D.get_cap (transform_pd_slot_ref word);
y <- assert (old_cap = cdl_cap.NullCap);
KHeap_D.set_cap (transform_pd_slot_ref word) (cdl_cap.PageTableCap p Fake None)
od) (store_pde word (PageTablePDE (addrFromPPtr p) attribs 0))
 2. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 3. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 4. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 5. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. ?P68 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 6. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. ?P'70 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 7. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 8. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
 9. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (9 subgoals):
 1. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres dc (?P68 a b word attribs p asid ()) (?P'70 a b word attribs p asid ()) (do old_cap <- KHeap_D.get_cap (transform_pd_slot_ref word);
y <- assert (old_cap = cdl_cap.NullCap);
KHeap_D.set_cap (transform_pd_slot_ref word) (cdl_cap.PageTableCap p Fake None)
od) (do _ <- return ();
store_pde word (PageTablePDE (addrFromPPtr p) attribs 0)
od)
 2. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 3. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 4. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 5. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. ?P68 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 6. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. ?P'70 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 7. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 8. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
 9. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (11 subgoals):
 1. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_\<rbrakk> \<Longrightarrow> dcorres dc (?R78 a b word attribs p asid rv) (?R'78 a b word attribs p asid uu_) (do y <- assert (rv = cdl_cap.NullCap);
KHeap_D.set_cap (transform_pd_slot_ref word) (cdl_cap.PageTableCap p Fake None)
od) (store_pde word (PageTablePDE (addrFromPPtr p) attribs 0))
 2. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q83 a b word attribs p asid ()\<rbrace> KHeap_D.get_cap (transform_pd_slot_ref word) \<lbrace>?R78 a b word attribs p asid\<rbrace>
 3. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'82 a b word attribs p asid ()\<rbrace> return () \<lbrace>?R'78 a b word attribs p asid\<rbrace>
 4. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 5. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 6. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 7. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and ?Q83 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 8. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'82 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 9. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 10. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_; rv = cdl_cap.NullCap\<rbrakk> \<Longrightarrow> dcorres dc (?P89 a b word attribs p asid rv) (?R'78 a b word attribs p asid uu_) (KHeap_D.set_cap (transform_pd_slot_ref word) (cdl_cap.PageTableCap p Fake None)) (store_pde word (PageTablePDE (addrFromPPtr p) attribs 0))
 2. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q83 a b word attribs p asid ()\<rbrace> KHeap_D.get_cap (transform_pd_slot_ref word) \<lbrace>\<lambda>rv s. rv = cdl_cap.NullCap \<and> ?P89 a b word attribs p asid rv s\<rbrace>
 3. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'82 a b word attribs p asid ()\<rbrace> return () \<lbrace>?R'78 a b word attribs p asid\<rbrace>
 4. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 5. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 6. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 7. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and ?Q83 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 8. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'82 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 9. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 10. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_; rv = cdl_cap.NullCap; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> dcorres dc (?P89 a b word attribs p asid rv) (?P'92 a b word attribs p asid uu_) (KHeap_D.set_cap (transform_pd_slot_ref word) (cdl_cap.PageTableCap p Fake None)) (store_pde word (PageTablePDE (addrFromPPtr p) attribs 0))
 2. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q83 a b word attribs p asid ()\<rbrace> KHeap_D.get_cap (transform_pd_slot_ref word) \<lbrace>\<lambda>rv s. rv = cdl_cap.NullCap \<and> ?P89 a b word attribs p asid rv s\<rbrace>
 3. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'82 a b word attribs p asid ()\<rbrace> return () \<lbrace>\<lambda>uu_. ?P'92 a b word attribs p asid uu_ and (\<lambda>s. UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots)\<rbrace>
 4. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 5. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 6. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 7. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and ?Q83 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 8. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'82 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 9. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 10. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
A total of 11 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_; rv = cdl_cap.NullCap; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> transform_pd_slot_ref word = transform_pd_slot_ref word
 2. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_; rv = cdl_cap.NullCap; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> cdl_cap.PageTableCap p Fake None = transform_pde (PageTablePDE (addrFromPPtr p) attribs 0)
 3. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_; rv = cdl_cap.NullCap; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 4. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q83 a b word attribs p asid ()\<rbrace> KHeap_D.get_cap (transform_pd_slot_ref word) \<lbrace>\<lambda>rv s. rv = cdl_cap.NullCap \<and> True\<rbrace>
 5. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'82 a b word attribs p asid ()\<rbrace> return () \<lbrace>\<lambda>_. valid_idle and (\<lambda>s. UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots)\<rbrace>
 6. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 7. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 8. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 9. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and ?Q83 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 10. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'82 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b word attribs p asid rv. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (p - pptrBaseOffset) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); rv = cdl_cap.NullCap; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> p = ptrFromPAddr (p - pptrBaseOffset)
 2. \<And>a b word attribs p asid rv uu_. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc rv uu_; rv = cdl_cap.NullCap; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 3. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q83 a b word attribs p asid ()\<rbrace> KHeap_D.get_cap (transform_pd_slot_ref word) \<lbrace>\<lambda>rv s. rv = cdl_cap.NullCap \<and> True\<rbrace>
 4. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'82 a b word attribs p asid ()\<rbrace> return () \<lbrace>\<lambda>_. valid_idle and (\<lambda>s. UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots)\<rbrace>
 5. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid y ya) (?R'67 a b word attribs p asid y ya) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 6. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 7. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 8. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and ?Q83 a b word attribs p asid y and ?Q69 a b word attribs p asid y\<rbrace>
 9. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and ?Q'82 a b word attribs p asid ya and ?Q'71 a b word attribs p asid ya\<rbrace>
 10. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
A total of 12 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> dcorres dc (?R67 a b word attribs p asid () ()) (?R'67 a b word attribs p asid () ()) (return ()) (do_machine_op (cleanByVA_PoU word (addrFromPPtr word)))
 2. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x. ?R67 a b word attribs p asid y ya\<rbrace>
 3. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x. ?R'67 a b word attribs p asid y ya\<rbrace>
 4. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and (\<lambda>a. opt_cap (transform_pd_slot_ref word) a \<noteq> None \<longrightarrow> the (opt_cap (transform_pd_slot_ref word) a) = cdl_cap.NullCap \<and> True) and ?Q69 a b word attribs p asid y\<rbrace>
 5. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and (valid_idle and (\<lambda>s. UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots)) and ?Q'71 a b word attribs p asid ya\<rbrace>
 6. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 7. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
 8. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (8 subgoals):
 1. \<And>a b word attribs p asid m. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ms. underlying_memory ms = m\<rbrace> cleanByVA_PoU word (addrFromPPtr word) \<lbrace>\<lambda>rv ms. underlying_memory ms = m\<rbrace>
 2. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q69 a b word attribs p asid y\<rbrace> insert_cap_orphan (cdl_cap.PageTableCap p Fake None) (transform_pd_slot_ref word) \<lbrace>\<lambda>x a. True\<rbrace>
 3. \<And>a b word attribs p asid y ya. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); dc y ya\<rbrakk> \<Longrightarrow> \<lbrace>?Q'71 a b word attribs p asid ya\<rbrace> store_pde word (PageTablePDE (addrFromPPtr p) attribs 0) \<lbrace>\<lambda>x a. True\<rbrace>
 4. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q53 a b word attribs p asid\<rbrace> KHeap_D.set_cap (transform_cslot_ptr (a, b)) (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<lbrace>\<lambda>y. (\<lambda>s. opt_cap (transform_pd_slot_ref word) s \<noteq> None) and (\<lambda>a. opt_cap (transform_pd_slot_ref word) a \<noteq> None \<longrightarrow> the (opt_cap (transform_pd_slot_ref word) a) = cdl_cap.NullCap \<and> True) and ?Q69 a b word attribs p asid y\<rbrace>
 5. \<And>a b word attribs p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word)\<rbrakk> \<Longrightarrow> \<lbrace>?Q'53 a b word attribs p asid\<rbrace> CSpaceAcc_A.set_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) \<lbrace>\<lambda>ya. (\<lambda>_. True) and (valid_idle and (\<lambda>s. UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots)) and ?Q'71 a b word attribs p asid ya\<rbrace>
 6. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q53 a b word attribs p asid) s
 7. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and ?Q'53 a b word attribs p asid) s'
 8. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. if transform_pd_slot_ref word = transform_cslot_ptr (a, b) then Some (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<noteq> None \<and> (Some (cdl_cap.PageTableCap p Real (transform_mapping asid)) \<noteq> None \<longrightarrow> the (Some (cdl_cap.PageTableCap p Real (transform_mapping asid))) = cdl_cap.NullCap \<and> True) \<and> True else opt_cap (transform_pd_slot_ref word) s \<noteq> None \<and> (opt_cap (transform_pd_slot_ref word) s \<noteq> None \<longrightarrow> the (opt_cap (transform_pd_slot_ref word) s) = cdl_cap.NullCap \<and> True) \<and> True)) s
 2. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and (\<lambda>s. True \<and> valid_idle s \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> True)) s'
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>a b word attribs p asid s' pd ref y ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) s'; ako_at (arch_kernel_obj.PageDirectory pd) (word && ~~ mask pd_bits) s'; pd (UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2)) = InvalidPDE; cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> transform_pd_slot_ref word \<noteq> transform_cslot_ptr (a, b) \<and> (transform_pd_slot_ref word \<noteq> transform_cslot_ptr (a, b) \<longrightarrow> (\<exists>y. opt_cap (transform_pd_slot_ref word) (transform s') = Some y) \<and> ((\<exists>y. opt_cap (transform_pd_slot_ref word) (transform s') = Some y) \<longrightarrow> the (opt_cap (transform_pd_slot_ref word) (transform s')) = cdl_cap.NullCap))
 2. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and (\<lambda>s. True \<and> valid_idle s \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> True)) s'
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>a b word attribs p asid s' pd ref y ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) s'; ako_at (arch_kernel_obj.PageDirectory pd) (word && ~~ mask pd_bits) s'; pd (UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2)) = InvalidPDE; cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'; opt_cap (transform_pd_slot_ref word) (transform s') = Some (transform_pde (kernel_pde_mask pd (UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2))))\<rbrakk> \<Longrightarrow> transform_pd_slot_ref word \<noteq> transform_cslot_ptr (a, b) \<and> (transform_pd_slot_ref word \<noteq> transform_cslot_ptr (a, b) \<longrightarrow> transform_pde (kernel_pde_mask pd (UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2))) = cdl_cap.NullCap)
 2. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and (\<lambda>s. True \<and> valid_idle s \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> True)) s'
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>b word attribs p asid s' pd ref y ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (word && ~~ mask pd_bits, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (word && ~~ mask pd_bits, nat (bl_to_bin b)) (word && ~~ mask pd_bits, nat (bl_to_bin b)); attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (word && ~~ mask pd_bits, b) s'; ako_at (arch_kernel_obj.PageDirectory pd) (word && ~~ mask pd_bits) s'; pd (UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2)) = InvalidPDE; cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'; opt_cap (word && ~~ mask pd_bits, nat (bl_to_bin b)) (transform s') = Some (case if UCAST(32 \<rightarrow> 12) (kernel_base >> 20) \<le> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) then InvalidPDE else pd (UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2)) of InvalidPDE \<Rightarrow> cdl_cap.NullCap | PageTablePDE ref x xa \<Rightarrow> cdl_cap.PageTableCap (transform_paddr ref) Fake None | SectionPDE ref x xa rights_ \<Rightarrow> FrameCap False (transform_paddr ref) rights_ (pageBitsForSize ARMSection) Fake None | SuperSectionPDE ref x rights_ \<Rightarrow> FrameCap False (transform_paddr ref) rights_ (pageBitsForSize ARMSuperSection) Fake None); typ_at (AArch APageDirectory) (word && ~~ mask pd_bits) s'; is_aligned word 2; unat (word && mask pd_bits >> 2) = nat (bl_to_bin b)\<rbrakk> \<Longrightarrow> False
 2. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); True; (pde_at word and (\<lambda>s. attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits) and typ_at (AArch APageTable) p and valid_cap (ArchObjectCap (arch_cap.PageTableCap p asid)) and cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) and empty_pde_at word and (\<lambda>s. \<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s \<and> valid_vspace_obj ao s) \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) and (\<lambda>y. \<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) and invs and valid_etcbs) s'; (s, s') \<in> {ss'. transform (snd ss') = fst ss'}\<rbrakk> \<Longrightarrow> ((\<lambda>s. valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s) and (\<lambda>s. True \<and> valid_idle s \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots \<and> True)) s'
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>a b word attribs p asid s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s' \<and> attribs \<subseteq> {ParityEnabled} \<and> is_aligned (addrFromPPtr p) pt_bits \<and> typ_at (AArch APageTable) p s' \<and> s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid) \<and> cte_wp_at (\<lambda>c. is_arch_update (ArchObjectCap (arch_cap.PageTableCap p asid)) c \<and> cap_asid c = None) (a, b) s' \<and> empty_pde_at word s' \<and> (\<exists>ref. vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref) \<and> (ref \<rhd> (word && ~~ mask pd_bits)) s' \<and> pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p \<and> (\<exists>ao. ako_at ao p s' \<and> valid_vspace_obj ao s') \<and> hd (the (vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)))) \<notin> kernel_vsrefs) \<and> (\<exists>y. cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y) \<and> invs s' \<and> valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> valid_idle s' \<and> a \<noteq> idle_thread s' \<and> valid_idle s' \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> valid_idle s' \<and> a \<noteq> idle_thread s' \<and> valid_idle s' \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s' \<and> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s'
 2. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'; \<not> a \<noteq> idle_thread s'\<rbrakk> \<Longrightarrow> False
 2. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (3 subgoals):
 1. \<And>b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (idle_thread s', b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (idle_thread s', b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (idle_thread s', b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> False
 2. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 3. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (7 subgoals):
 1. \<And>b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (idle_thread s', b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (idle_thread s', b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> if_unsafe_then_cap s'
 2. \<And>b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (idle_thread s', b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (idle_thread s', b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> valid_global_refs s'
 3. \<And>b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (idle_thread s', b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (idle_thread s', b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> valid_idle s'
 4. \<And>b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (idle_thread s', b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (idle_thread s', b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> valid_irq_node s'
 5. \<And>b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (idle_thread s', b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (idle_thread s', b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'; ArchObjectCap (arch_cap.PageTableCap p data) = cap.NullCap\<rbrakk> \<Longrightarrow> False
 6. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; invs s'; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'\<rbrakk> \<Longrightarrow> UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<notin> kernel_mapping_slots
 7. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (2 subgoals):
 1. \<And>a b word attribs p asid s' ref y data ao. \<lbrakk>ptinv' = page_table_invocation.PageTableMap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b) (PageTablePDE (addrFromPPtr p) attribs 0) word; ptinv = cdl_page_table_invocation.PageTableMap (cdl_cap.PageTableCap p Real (transform_mapping asid)) (cdl_cap.PageTableCap p Fake None) (transform_cslot_ptr (a, b)) (transform_pd_slot_ref word); pde_at word s'; attribs \<subseteq> {ParityEnabled}; is_aligned (addrFromPPtr p) pt_bits; typ_at (AArch APageTable) p s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); empty_pde_at word s'; caps_of_state s' (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p data)); is_arch_cap (ArchObjectCap (arch_cap.PageTableCap p asid)); cap_asid (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some y; vs_cap_ref (ArchObjectCap (arch_cap.PageTableCap p asid)) = Some (VSRef (word && mask pd_bits >> 2) (Some APageDirectory) # ref); cap_asid (ArchObjectCap (arch_cap.PageTableCap p data)) = None; valid_etcbs s'; (ref \<rhd> (word && ~~ mask pd_bits)) s'; pde_ref (PageTablePDE (addrFromPPtr p) attribs 0) = Some p; VSRef (word && mask pd_bits >> 2) (Some APageDirectory) \<notin> kernel_vsrefs; ako_at ao p s'; valid_vspace_obj ao s'; valid_pspace s'; valid_mdb s'; valid_ioc s'; valid_idle s'; only_idle s'; if_unsafe_then_cap s'; valid_reply_caps s'; valid_reply_masters s'; valid_global_refs s'; valid_arch_state s'; valid_irq_node s'; valid_irq_handlers s'; valid_irq_states s'; valid_machine_state s'; valid_vspace_objs s'; valid_arch_caps s'; valid_global_objs s'; valid_kernel_mappings s'; equal_kernel_mappings s'; valid_asid_map s'; valid_global_vspace_mappings s'; pspace_in_kernel_window s'; cap_refs_in_kernel_window s'; pspace_respects_device_region s'; cap_refs_respects_device_region s'; cur_tcb s'; UCAST(32 \<rightarrow> 12) (word && mask pd_bits >> 2) \<in> kernel_mapping_slots\<rbrakk> \<Longrightarrow> False
 2. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (1 subgoal):
 1. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (get_pt_mapped_addr x21) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case get_pt_mapped_addr x21 of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (1 subgoal):
 1. \<And>x21 a b. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (case x21 of ArchObjectCap (arch_cap.PageTableCap p asid) \<Rightarrow> transform_mapping asid | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) (obj_ref_of x21) (transform_cslot_ptr (a, b))\<rbrakk> \<Longrightarrow> dcorres dc (\<lambda>_. True) (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) (do y <- case case x21 of ArchObjectCap (arch_cap.PageTableCap p asid) \<Rightarrow> transform_mapping asid | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (1 subgoal):
 1. \<And>x21 a b s s'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap x21 (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (case x21 of ArchObjectCap (arch_cap.PageTableCap p asid) \<Rightarrow> transform_mapping asid | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None) (obj_ref_of x21) (transform_cslot_ptr (a, b)); s = transform s'; True; (valid_pti (page_table_invocation.PageTableUnmap x21 (a, b)) and invs and valid_etcbs) s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) s) ((=) s') (do y <- case case x21 of ArchObjectCap (arch_cap.PageTableCap p asid) \<Rightarrow> transform_mapping asid | ArchObjectCap _ \<Rightarrow> None | _ \<Rightarrow> None of None \<Rightarrow> return () | Some maddr \<Rightarrow> do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of x21);
clear_object_caps (obj_ref_of x21) \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (case x21 of ArchObjectCap (arch_cap.PageTableCap p mapped_address) \<Rightarrow> do case mapped_address of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap $ CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap $ update_map_data cap None) (a, b)
od | ArchObjectCap _ \<Rightarrow> fail | _ \<Rightarrow> fail) proof (prove)
goal (1 subgoal):
 1. \<And>a b s' p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b s' p asid. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = None\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od)
 2. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 2. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (4 subgoals):
 1. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc (?Q269 a b s' p) (?Q'269 a b s' p) (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 2. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ?Q269 a b s' p s
 3. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> ?Q'269 a b s' p s
 4. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres (?r'273 a b s' p) (?P273 a b s' p) (?P'273 a b s' p) (KHeap_D.get_cap (transform_cslot_ptr (a, b))) (CSpaceAcc_A.get_cap (a, b))
 2. \<And>a b s' p cap x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; ?r'273 a b s' p cap x\<rbrakk> \<Longrightarrow> dcorres dc (?R273 a b s' p cap) (?R'273 a b s' p x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b))
 3. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 a b s' p\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R273 a b s' p\<rbrace>
 4. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'273 a b s' p\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'273 a b s' p\<rbrace>
 5. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> (?P273 a b s' p and ?Q273 a b s' p) s
 6. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (?P'273 a b s' p and ?Q'273 a b s' p) s
 7. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (6 subgoals):
 1. \<And>a b s' p cap x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cap = transform_cap x\<rbrakk> \<Longrightarrow> dcorres dc (?R273 a b s' p cap) (?R'273 a b s' p x) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b))
 2. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 a b s' p\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R273 a b s' p\<rbrace>
 3. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'273 a b s' p\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'273 a b s' p\<rbrace>
 4. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q273 a b s' p) s
 5. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'273 a b s' p) s
 6. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' p cap x s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cap = transform_cap x; cte_wp_at ((=) x) (a, b) s \<and> s = s'\<rbrakk> \<Longrightarrow> reset_mem_mapping cap = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' p cap x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 a b s' p\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'273 a b s' p\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q273 a b s' p) s
 6. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'273 a b s' p) s
 7. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' p x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cte_wp_at ((=) x) (a, b) s'\<rbrakk> \<Longrightarrow> reset_mem_mapping (transform_cap x) = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' p cap x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 a b s' p\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'273 a b s' p\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q273 a b s' p) s
 6. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'273 a b s' p) s
 7. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (7 subgoals):
 1. \<And>a b s' p x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cte_wp_at ((=) x) (a, b) s'; x = ArchObjectCap (arch_cap.PageTableCap p None)\<rbrakk> \<Longrightarrow> reset_mem_mapping (transform_cap x) = transform_cap (ArchObjectCap (update_map_data (the_arch_cap x) None))
 2. \<And>a b s' p cap x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 a b s' p\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'273 a b s' p\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q273 a b s' p) s
 6. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'273 a b s' p) s
 7. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (6 subgoals):
 1. \<And>a b s' p cap x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; cap = transform_cap x\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 2. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q273 a b s' p\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 3. \<And>a b s' p. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'273 a b s' p\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>x s. (cte_wp_at ((=) x) (a, b) s \<and> s = s') \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q273 a b s' p) s
 5. \<And>a b s' p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'273 a b s' p) s
 6. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p None))) (a, b) s; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; invs s; valid_etcbs s\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread a s \<and> cte_wp_at (\<lambda>cap. True) (a, b) s \<and> valid_idle s \<and> a \<noteq> idle_thread s
 2. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (2 subgoals):
 1. \<And>a b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (a, b)); fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p None), s)}; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; invs s; valid_etcbs s\<rbrakk> \<Longrightarrow> valid_idle s \<and> not_idle_thread a s \<and> valid_idle s \<and> a \<noteq> idle_thread s
 2. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (2 subgoals):
 1. \<And>b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p None), s)}; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; valid_etcbs s; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False
 2. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (3 subgoals):
 1. \<And>b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p None), s)}; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; valid_etcbs s; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> caps_of_state s (idle_thread s, ?v335 b p s) = Some (?cap335 b p s)
 2. \<And>b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p None), s)}; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; valid_etcbs s; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap335 b p s = cap.NullCap\<rbrakk> \<Longrightarrow> False
 3. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (3 subgoals):
 1. \<And>b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p None), s)}; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; valid_etcbs s; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> Some (?cap335 b p s) = caps_of_state s (idle_thread s, ?v335 b p s)
 2. \<And>b p s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p None)) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap None p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p None), s)}; s \<turnstile> ArchObjectCap (arch_cap.PageTableCap p None); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p None)) s; valid_etcbs s; valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap335 b p s = cap.NullCap\<rbrakk> \<Longrightarrow> False
 3. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p asid)) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (map_option (\<lambda>x. (transform_asid (fst x), snd x)) asid) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p asid))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p asid); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p asid)) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- case asid of None \<Rightarrow> return () | Some x \<Rightarrow> ((\<lambda>maddr. do PageTableUnmap_D.unmap_page_table maddr (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid)));
clear_object_caps (obj_ref_of (ArchObjectCap (arch_cap.PageTableCap p asid))) \<sqinter> return ()
od) \<circ> (\<lambda>x. (transform_asid (fst x), snd x))) x;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case asid of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do local.unmap_page_table asid vaddr p;
pte_bits <- return 2;
slots <- return [p , p + (1 << pte_bits) .e. p + (1 << pt_bits) - 1];
mapM_x (swp store_pte InvalidPTE) slots;
do_machine_op $ cleanCacheRange_PoU p (p + (1 << pt_bits) - 1) (addrFromPPtr p)
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (1 subgoal):
 1. \<And>a b s' p asid aa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some aa))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid (fst aa), snd aa)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some aa)))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some aa)); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some aa))) s'; invs s'; valid_etcbs s'; asid = Some aa\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do y <- do y <- PageTableUnmap_D.unmap_page_table (transform_asid (fst aa), snd aa) p;
clear_object_caps p \<sqinter> return ()
od;
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- case aa of (asid, vaddr) \<Rightarrow> do y <- local.unmap_page_table asid vaddr p;
y <- mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1];
do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p))
od;
cap <- liftM the_arch_cap (CSpaceAcc_A.get_cap (a, b));
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data cap None)) (a, b)
od) proof (prove)
goal (1 subgoal):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc ((=) (transform s')) ((=) s') (do x <- PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p;
y <- clear_object_caps p \<sqinter> return ();
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- local.unmap_page_table aa ba p;
x <- mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1];
y <- do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p));
x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od) proof (prove)
goal (3 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres dc (?Q344 a b s' p aa ba) (?Q'344 a b s' p aa ba) (do x <- PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p;
y <- clear_object_caps p \<sqinter> return ();
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- local.unmap_page_table aa ba p;
x <- mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1];
y <- do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p));
x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 2. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ?Q344 a b s' p aa ba s
 3. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> ?Q'344 a b s' p aa ba s proof (prove)
goal (6 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> dcorres (?r'348 a b s' p aa ba) (?P348 a b s' p aa ba) (?P'348 a b s' p aa ba) (PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p) (local.unmap_page_table aa ba p)
 2. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; ?r'348 a b s' p aa ba x xa\<rbrakk> \<Longrightarrow> dcorres dc (?R348 a b s' p aa ba x) (?R'348 a b s' p aa ba xa) (do y <- clear_object_caps p \<sqinter> return ();
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1];
y <- do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p));
x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 3. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>?R348 a b s' p aa ba\<rbrace>
 4. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>?R'348 a b s' p aa ba\<rbrace>
 5. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> (?P348 a b s' p aa ba and ?Q348 a b s' p aa ba) s
 6. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (?P'348 a b s' p aa ba and ?Q'348 a b s' p aa ba) s proof (prove)
goal (5 subgoals):
 1. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> dcorres dc (?R348 a b s' p aa ba x) (?R'348 a b s' p aa ba xa) (do y <- clear_object_caps p \<sqinter> return ();
cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1];
y <- do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p));
x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 2. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>?R348 a b s' p aa ba\<rbrace>
 3. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>?R'348 a b s' p aa ba\<rbrace>
 4. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 5. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (7 subgoals):
 1. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R365 a b s' p aa ba x xa rv) (?R'365 a b s' p aa ba x xa rv') (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do y <- do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p));
x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 2. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>?R365 a b s' p aa ba x xa\<rbrace>
 3. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 4. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 5. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
 6. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 7. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (9 subgoals):
 1. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres dc (?R365 a b s' p aa ba x xa rv) (?Q'371 a b s' p aa ba x xa rv rv' rva) (do cap <- KHeap_D.get_cap (transform_cslot_ptr (a, b));
KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)
od) (do x <- CSpaceAcc_A.get_cap (a, b);
CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap x) None)) (a, b)
od)
 2. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'365 a b s' p aa ba x xa rv'\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>?Q'371 a b s' p aa ba x xa rv rv'\<rbrace>
 3. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 4. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>?R365 a b s' p aa ba x xa\<rbrace>
 5. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 6. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 7. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
 8. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 9. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (12 subgoals):
 1. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> dcorres (?r'375 a b s' p aa ba x xa rv rv' rva) (?P376 a b s' p aa ba x xa rv) (?P'375 a b s' p aa ba x xa rv rv' rva) (KHeap_D.get_cap (transform_cslot_ptr (a, b))) (CSpaceAcc_A.get_cap (a, b))
 2. \<And>a b s' p aa ba x xa rv rv' rva cap xb. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'; ?r'375 a b s' p aa ba x xa rv rv' rva cap xb\<rbrakk> \<Longrightarrow> dcorres dc (?R375 a b s' p aa ba x xa rv rv' rva cap) (?R'375 a b s' p aa ba x xa rv rv' rva xb) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap xb) None)) (a, b))
 3. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q377 a b s' p aa ba x xa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R375 a b s' p aa ba x xa rv rv' rva\<rbrace>
 4. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'375 a b s' p aa ba x xa rv rv' rva\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'375 a b s' p aa ba x xa rv rv' rva\<rbrace>
 5. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'365 a b s' p aa ba x xa rv'\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r. ?P'375 a b s' p aa ba x xa rv rv' r and ?Q'375 a b s' p aa ba x xa rv rv' r\<rbrace>
 6. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>\<lambda>rv. ?P376 a b s' p aa ba x xa rv and ?Q377 a b s' p aa ba x xa rv\<rbrace>
 8. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 9. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 10. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b s' p aa ba x xa rv rv' rva cap xb. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'; cap = transform_cap xb\<rbrakk> \<Longrightarrow> dcorres dc (?R375 a b s' p aa ba x xa rv rv' rva cap) (?R'375 a b s' p aa ba x xa rv rv' rva xb) (KHeap_D.set_cap (transform_cslot_ptr (a, b)) (reset_mem_mapping cap)) (CSpaceAcc_A.set_cap (ArchObjectCap (update_map_data (the_arch_cap xb) None)) (a, b))
 2. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q377 a b s' p aa ba x xa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>?R375 a b s' p aa ba x xa rv rv' rva\<rbrace>
 3. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'375 a b s' p aa ba x xa rv rv' rva\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>?R'375 a b s' p aa ba x xa rv rv' rva\<rbrace>
 4. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'365 a b s' p aa ba x xa rv'\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'375 a b s' p aa ba x xa rv rv' r\<rbrace>
 5. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q377 a b s' p aa ba x xa rv\<rbrace>
 7. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 8. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 9. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
 10. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b s' p aa ba x xa rv rv' rva cap xb s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'; cap = transform_cap xb; cte_wp_at ((=) xb) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> reset_mem_mapping cap = transform_cap (ArchObjectCap (update_map_data (the_arch_cap xb) None))
 2. \<And>a b s' p aa ba x xa rv rv' rva cap xb. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'; cap = transform_cap xb\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q377 a b s' p aa ba x xa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'375 a b s' p aa ba x xa rv rv' rva\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>xb s. (cte_wp_at ((=) xb) (a, b) s \<and> caps_of_state s' = caps_of_state s) \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'365 a b s' p aa ba x xa rv'\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'375 a b s' p aa ba x xa rv rv' r\<rbrace>
 6. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q377 a b s' p aa ba x xa rv\<rbrace>
 8. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 9. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 10. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); caps_of_state s (a, b) = Some (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))); s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> cdl_cap.PageTableCap p Real None = transform_cap (ArchObjectCap (update_map_data (arch_cap.PageTableCap p (Some (aa, ba))) None))
 2. \<And>a b s' p aa ba x xa rv rv' rva cap xb. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'; cap = transform_cap xb\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 3. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q377 a b s' p aa ba x xa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 4. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'375 a b s' p aa ba x xa rv rv' rva\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>xb s. (cte_wp_at ((=) xb) (a, b) s \<and> caps_of_state s' = caps_of_state s) \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 5. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'365 a b s' p aa ba x xa rv'\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'375 a b s' p aa ba x xa rv rv' r\<rbrace>
 6. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 7. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q377 a b s' p aa ba x xa rv\<rbrace>
 8. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 9. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 10. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>a b s' p aa ba x xa rv rv' rva cap xb. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'; cap = transform_cap xb\<rbrakk> \<Longrightarrow> transform_cslot_ptr (a, b) = transform_cslot_ptr (a, b)
 2. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q377 a b s' p aa ba x xa rv\<rbrace> KHeap_D.get_cap (transform_cslot_ptr (a, b)) \<lbrace>\<lambda>cap _. True\<rbrace>
 3. \<And>a b s' p aa ba x xa rv rv' rva. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'375 a b s' p aa ba x xa rv rv' rva\<rbrace> CSpaceAcc_A.get_cap (a, b) \<lbrace>\<lambda>xb s. (cte_wp_at ((=) xb) (a, b) s \<and> caps_of_state s' = caps_of_state s) \<and> valid_idle s \<and> fst (a, b) \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 4. \<And>a b s' p aa ba x xa rv rv'. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R'365 a b s' p aa ba x xa rv'\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r. valid_idle and not_idle_thread (fst (a, b)) and valid_etcbs and ?Q'375 a b s' p aa ba x xa rv rv' r\<rbrace>
 5. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 6. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and ?Q377 a b s' p aa ba x xa rv\<rbrace>
 7. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>?R'365 a b s' p aa ba x xa\<rbrace>
 8. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 9. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
 10. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
A total of 11 subgoals... proof (prove)
goal (8 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'408 a b s' p aa ba () () ()\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>rv s. not_idle_thread a s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>cap. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>a b s' p aa ba x xa rv rv' cs. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>ps. transform ps = cs\<rbrace> do_machine_op (cleanCacheRange_PoU p (p + 2 ^ pt_bits - 1) (addrFromPPtr p)) \<lbrace>\<lambda>r s. transform s = cs\<rbrace>
 3. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q368 a b s' p aa ba x\<rbrace> clear_object_caps p \<sqinter> return () \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>c. opt_cap (transform_cslot_ptr (a, b)) c \<noteq> None \<longrightarrow> True)\<rbrace>
 4. \<And>a b s' p aa ba x xa. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; dc x xa\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba xa\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>\<lambda>rv' s. valid_idle s \<and> ?P'408 a b s' p aa ba x xa rv' s\<rbrace>
 5. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ?Q368 a b s' p aa ba x\<rbrace>
 6. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
 7. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 8. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (5 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'370 a b s' p aa ba ()\<rbrace> mapM_x (swp store_pte InvalidPTE) [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<lbrace>\<lambda>rv' s. valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ((\<lambda>s. True \<and> ?P'466 a b s' p aa ba x s) and ((\<lambda>_. True) and (\<lambda>c. opt_cap (transform_cslot_ptr (a, b)) c \<noteq> None \<longrightarrow> True)))\<rbrace>
 3. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and ?Q'370 a b s' p aa ba xa\<rbrace>
 4. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 5. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (6 subgoals):
 1. \<And>a b s' p aa ba x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; x \<in> ?S476 a b s' p aa ba\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c\<rbrace> swp store_pte InvalidPTE x \<lbrace>\<lambda>rv' c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c\<rbrace>
 2. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> set [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<subseteq> ?S476 a b s' p aa ba
 3. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ((\<lambda>s. True \<and> ?P'466 a b s' p aa ba x s) and ((\<lambda>_. True) and (\<lambda>c. opt_cap (transform_cslot_ptr (a, b)) c \<noteq> None \<longrightarrow> True)))\<rbrace>
 4. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and (\<lambda>c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c)\<rbrace>
 5. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 6. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (6 subgoals):
 1. \<And>a b s' p aa ba x. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; x \<in> ?S476 a b s' p aa ba\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c\<rbrace> store_pte x InvalidPTE \<lbrace>\<lambda>rv' c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c\<rbrace>
 2. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> set [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<subseteq> ?S476 a b s' p aa ba
 3. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ((\<lambda>s. True \<and> ?P'466 a b s' p aa ba x s) and ((\<lambda>_. True) and (\<lambda>c. opt_cap (transform_cslot_ptr (a, b)) c \<noteq> None \<longrightarrow> True)))\<rbrace>
 4. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and (\<lambda>c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c)\<rbrace>
 5. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 6. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (5 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> set [p , p + 4 .e. p + 2 ^ pt_bits - 1] \<subseteq> ?S476 a b s' p aa ba
 2. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ((\<lambda>s. True \<and> ?P'466 a b s' p aa ba x s) and ((\<lambda>_. True) and (\<lambda>c. opt_cap (transform_cslot_ptr (a, b)) c \<noteq> None \<longrightarrow> True)))\<rbrace>
 3. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and (\<lambda>c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c)\<rbrace>
 4. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 5. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (4 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q348 a b s' p aa ba\<rbrace> PageTableUnmap_D.unmap_page_table (transform_asid aa, ba) p \<lbrace>\<lambda>x. (\<lambda>_. True) and ((\<lambda>s. True \<and> ?P'466 a b s' p aa ba x s) and ((\<lambda>_. True) and (\<lambda>c. opt_cap (transform_cslot_ptr (a, b)) c \<noteq> None \<longrightarrow> True)))\<rbrace>
 2. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?Q'348 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>xa. invs and cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) and (\<lambda>c. valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c \<and> cte_wp_at (\<lambda>a. True) (a, b) c \<and> caps_of_state s' = caps_of_state c \<and> valid_idle c \<and> a \<noteq> idle_thread c \<and> valid_etcbs c)\<rbrace>
 3. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and ?Q348 a b s' p aa ba) s
 4. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and ?Q'348 a b s' p aa ba) s proof (prove)
goal (3 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'523 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>rv s. valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s\<rbrace>
 2. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> (True \<and> ?P'511 a b s' p aa ba) \<and> True \<and> ?P'513 a b s' p aa ba s)) s
 3. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and (\<lambda>s. (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s \<and> ?P'523 a b s' p aa ba s)) s proof (prove)
goal (4 subgoals):
 1. \<And>a b s' p aa ba. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'\<rbrakk> \<Longrightarrow> \<lbrace>?P'523 a b s' p aa ba\<rbrace> local.unmap_page_table aa ba p \<lbrace>\<lambda>rv s. invs s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrace>
 2. \<And>a b s' p aa ba rv s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; invs s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s
 3. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> (True \<and> ?P'511 a b s' p aa ba) \<and> True \<and> ?P'513 a b s' p aa ba s)) s
 4. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and (\<lambda>s. (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s \<and> ?P'523 a b s' p aa ba s)) s proof (prove)
goal (3 subgoals):
 1. \<And>a b s' p aa ba rv s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; invs s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>_. True) (a, b) s \<and> caps_of_state s' = caps_of_state s\<rbrakk> \<Longrightarrow> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s \<and> valid_idle s \<and> a \<noteq> idle_thread s \<and> valid_etcbs s
 2. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> (True \<and> ?P'511 a b s' p aa ba) \<and> True \<and> ?P'513 a b s' p aa ba s)) s
 3. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and (\<lambda>s. (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s \<and> (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s)) s proof (prove)
goal (2 subgoals):
 1. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; transform s' = s\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. True \<and> (True \<and> ?P'511 a b s' p aa ba) \<and> True \<and> ?P'513 a b s' p aa ba s)) s
 2. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and (\<lambda>s. (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s \<and> (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s)) s proof (prove)
goal (1 subgoal):
 1. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s'; s' \<turnstile> ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s'; invs s'; valid_etcbs s'; s' = s\<rbrakk> \<Longrightarrow> (invs and valid_cap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) and (\<lambda>s. (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s \<and> (invs and K (aa \<le> mask local.asid_bits \<and> ba < kernel_base \<and> vmsz_aligned ba ARMSection)) s \<and> valid_etcbs s \<and> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>a. True) (a, b) s \<and> caps_of_state s' = caps_of_state s)) s proof (prove)
goal (1 subgoal):
 1. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); cte_wp_at ((=) (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))))) (a, b) s; cap_aligned (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) \<and> typ_at (AArch APageTable) p s \<and> 0 < aa \<and> aa < 2 ^ local.asid_bits \<and> ba < kernel_base \<and> is_aligned ba 20; IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; invs s; valid_etcbs s; s' = s\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s \<and> cte_wp_at (\<lambda>a. True) (a, b) s proof (prove)
goal (1 subgoal):
 1. \<And>a b s' p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (a, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (a, b)); fst (CSpaceAcc_A.get_cap (a, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))), s)}; is_aligned p 10 \<and> 10 < word_bits \<and> typ_at (AArch APageTable) p s \<and> 0 < aa \<and> aa < 2 ^ local.asid_bits \<and> ba < kernel_base \<and> is_aligned ba 20; IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; invs s; valid_etcbs s; s' = s\<rbrakk> \<Longrightarrow> a \<noteq> idle_thread s proof (prove)
goal (1 subgoal):
 1. \<And>b p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))), s)}; IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; valid_etcbs s; is_aligned p 10; valid_pspace s; 10 < word_bits; valid_mdb s; typ_at (AArch APageTable) p s; valid_ioc s; 0 < aa; valid_idle s; aa < 2 ^ local.asid_bits; only_idle s; ba < kernel_base; is_aligned ba 20; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>b p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))), s)}; IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; valid_etcbs s; is_aligned p 10; valid_pspace s; 10 < word_bits; valid_mdb s; typ_at (AArch APageTable) p s; valid_ioc s; 0 < aa; valid_idle s; aa < 2 ^ local.asid_bits; only_idle s; ba < kernel_base; is_aligned ba 20; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> caps_of_state s (idle_thread s, ?v576 b p aa ba s) = Some (?cap576 b p aa ba s)
 2. \<And>b p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))), s)}; IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; valid_etcbs s; is_aligned p 10; valid_pspace s; 10 < word_bits; valid_mdb s; typ_at (AArch APageTable) p s; valid_ioc s; 0 < aa; valid_idle s; aa < 2 ^ local.asid_bits; only_idle s; ba < kernel_base; is_aligned ba 20; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap576 b p aa ba s = cap.NullCap\<rbrakk> \<Longrightarrow> False proof (prove)
goal (2 subgoals):
 1. \<And>b p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (idle_thread s, b)); Some (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) = caps_of_state s (idle_thread s, b); IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; valid_etcbs s; is_aligned p 10; valid_pspace s; 10 < word_bits; valid_mdb s; typ_at (AArch APageTable) p s; valid_ioc s; 0 < aa; valid_idle s; aa < 2 ^ local.asid_bits; only_idle s; ba < kernel_base; is_aligned ba 20; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> caps_of_state s (idle_thread s, ?v576 b p aa ba s) = Some (?cap576 b p aa ba s)
 2. \<And>b p aa ba s. \<lbrakk>ptinv' = page_table_invocation.PageTableUnmap (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) (idle_thread s, b); ptinv = cdl_page_table_invocation.PageTableUnmap (Some (transform_asid aa, ba)) p (transform_cslot_ptr (idle_thread s, b)); fst (CSpaceAcc_A.get_cap (idle_thread s, b) s) = {(ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba))), s)}; IpcCancel_A.is_final_cap' (ArchObjectCap (arch_cap.PageTableCap p (Some (aa, ba)))) s; valid_etcbs s; is_aligned p 10; valid_pspace s; 10 < word_bits; valid_mdb s; typ_at (AArch APageTable) p s; valid_ioc s; 0 < aa; valid_idle s; aa < 2 ^ local.asid_bits; only_idle s; ba < kernel_base; is_aligned ba 20; valid_reply_caps s; valid_reply_masters s; valid_global_refs s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; ?cap576 b p aa ba s = cap.NullCap\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!