theory Arch_C

lemma performPageTableInvocationUnmap_ccorres:
  "ccorres (K (K \<bottom>) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and cte_wp_at' ((=) (ArchObjectCap cap) \<circ> cteCap) ctSlot
              and (\<lambda>_. isPageTableCap cap))
       (UNIV \<inter> \<lbrace>ccap_relation (ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = Ptr ctSlot\<rbrace>)
       []
       (liftE (performPageTableInvocation (PageTableUnmap cap ctSlot)))
       (Call performPageTableInvocationUnmap_'proc)" apply (simp only: liftE_liftM ccorres_liftM_simp) apply (rule ccorres_gen_asm) apply (cinit lift: cap_' ctSlot_') apply csymbr apply (simp del: Collect_const) apply (rule ccorres_split_nothrow_novcg_dc) apply (subgoal_tac "capPTMappedAddress cap
                           = (\<lambda>cp. if to_bool (capPTIsMapped_CL cp)
                              then Some (capPTMappedASID_CL cp, capPTMappedAddress_CL cp)
                              else None) (cap_page_table_cap_lift capa)") apply (rule ccorres_Cond_rhs) apply (simp add: to_bool_def) apply (rule ccorres_rhs_assoc)+ apply csymbr apply csymbr apply csymbr apply csymbr apply (ctac add: unmapPageTable_ccorres) apply csymbr apply (simp add: storePTE_def swp_def) apply (ctac add: clearMemory_PT_setObject_PTE_ccorres) apply wp apply (simp del: Collect_const) apply (vcg exspec=unmapPageTable_modifies) apply simp apply (rule ccorres_return_Skip') apply (simp add: cap_get_tag_isCap_ArchObject[symmetric]) apply (clarsimp simp: cap_lift_page_table_cap cap_to_H_def
                            cap_page_table_cap_lift_def
                     elim!: ccap_relationE cong: if_cong) apply (simp add: liftM_def getSlotCap_def updateCap_def
                 del: Collect_const) apply (rule ccorres_move_c_guard_cte) apply (rule ccorres_getCTE)+ apply (rule_tac P="cte_wp_at' ((=) rv) ctSlot
                          and (\<lambda>_. rv = rva \<and> isArchCap isPageTableCap (cteCap rv))"
                in ccorres_from_vcg_throws [where P'=UNIV]) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp: cte_wp_at_ctes_of cap_get_tag_isCap_ArchObject) apply (rule cmap_relationE1[OF cmap_relation_cte], assumption+) apply (frule ccte_relation_ccap_relation) apply (clarsimp simp: typ_heap_simps cap_get_tag_isCap_ArchObject) apply (rule fst_setCTE [OF ctes_of_cte_at], assumption) apply (erule rev_bexI) apply (clarsimp simp: rf_sr_def cstate_relation_def Let_def
                           typ_heap_simps') apply (rule conjI) apply (clarsimp simp: cpspace_relation_def typ_heap_simps') apply (subst setCTE_tcb_case, assumption+) apply (clarsimp dest!: ksPSpace_update_eq_ExD) apply (erule cmap_relation_updI, assumption) apply (simp add: cap_get_tag_isCap_ArchObject[symmetric]) apply (clarsimp simp: ccte_relation_def c_valid_cte_def
                      elim!: ccap_relationE) apply (subst cteCap_update_cte_to_H) apply (clarsimp simp: map_option_Some_eq2) apply (rule trans, rule sym, rule option.sel, rule sym, erule arg_cong) apply (erule iffD1[OF cap_page_table_cap_lift]) apply (clarsimp simp: map_option_Some_eq2 cap_get_tag_isCap_ArchObject[symmetric]
                             cap_lift_page_table_cap cap_to_H_def
                             cap_page_table_cap_lift_def) apply simp apply (clarsimp simp: carch_state_relation_def cmachine_state_relation_def
                           typ_heap_simps'
                           cvariable_array_map_const_add_map_option[where f="tcb_no_ctes_proj"]
                    dest!: ksPSpace_update_eq_ExD) apply (simp add: cte_wp_at_ctes_of) apply (wp mapM_x_wp' | wpc | simp)+ apply (simp add: guard_is_UNIV_def) apply (clarsimp simp: cap_get_tag_isCap_ArchObject[symmetric] cte_wp_at_ctes_of) apply (frule ctes_of_valid', clarsimp) apply (frule valid_global_refsD_with_objSize, clarsimp) apply (clarsimp simp: cap_lift_page_table_cap cap_to_H_def
                        cap_page_table_cap_lift_def isCap_simps
                        valid_cap'_def get_capSizeBits_CL_def
                        ptBits_def pageBits_def capAligned_def
                        to_bool_def mask_def page_table_at'_def
                        capRange_def Int_commute pteBits_def
                 elim!: ccap_relationE cong: if_cong) apply (drule spec[where x=0], clarsimp) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>_. isPageTableCap cap)) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr ctSlot\<rbrace>) [] (liftE (performPageTableInvocation (ARM_H.PageTableUnmap cap ctSlot))) (Call performPageTableInvocationUnmap_'proc) proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot and (\<lambda>_. isPageTableCap cap)) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr ctSlot\<rbrace>) [] (performPageTableInvocation (ARM_H.PageTableUnmap cap ctSlot)) (Call performPageTableInvocationUnmap_'proc) proof (prove)
goal (1 subgoal):
 1. isPageTableCap cap \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) (UNIV \<inter> \<lbrace>ccap_relation (capability.ArchObjectCap cap) \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr ctSlot\<rbrace>) [] (performPageTableInvocation (ARM_H.PageTableUnmap cap ctSlot)) (Call performPageTableInvocationUnmap_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q557 ctSlota capa) (?Q'557 ctSlota capa) [SKIP] (do y <- case capPTMappedAddress cap of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od;
cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTIsMapped_'proc(capa);;
(IF \<acute>ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(unit \<rightarrow> 32 word) (PTR_COERCE(pte_C \<rightarrow> unit) \<acute>pt),\<acute>ret__unsigned_long)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q557 ctSlota capa s \<and> s' \<in> ?Q'557 ctSlota capa proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q557 ctSlota capa) (?G'566 ctSlota capa ret__unsigned) [SKIP] (do y <- case capPTMappedAddress cap of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od;
cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (IF ret__unsigned \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(UCAST(32 \<rightarrow> 32) \<acute>ret__unsigned,UCAST(32 \<rightarrow> 32) \<acute>unsigned_eret_2,\<acute>pt);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(unit \<rightarrow> 32 word) (PTR_COERCE(pte_C \<rightarrow> unit) \<acute>pt),\<acute>ret__unsigned_long)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlota} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(ctSlota\<rightarrow>[''cap_C'']),SCAST(32 signed \<rightarrow> 32) 0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q557 ctSlota capa s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'566 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q557 (cte_Ptr ctSlot) capa) (?G'566 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [SKIP] (do y <- case capPTMappedAddress cap of None \<Rightarrow> return () | Some (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od;
cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (IF capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long)
FI;;
(Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q557 ctSlota capa s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'566 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P721 (cte_Ptr ctSlot) capa) (?G'566 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) (IF capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long)
FI)
 2. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P721 ctSlota capa and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'566 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P721 (cte_Ptr ctSlot) capa) (?G'566 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) (IF capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 THEN
  \<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long)
FI)
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 3. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P721 ctSlota capa and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> ?G'566 ctSlota capa v}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?S735 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> ?S735 ctSlota capa v) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?S735 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (do y <- unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap);
y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> ?S735 ctSlota capa v) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?S735 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (do y <- unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap);
y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTBasePtr_'proc(capa);;
(\<acute>pt :== pte_Ptr \<acute>ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
(\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
(CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
(\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long)))))))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> ?S735 ctSlota capa v) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsigned = capPTBasePtr_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?G'773 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsigned) [] (do y <- unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap);
y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (\<acute>pt :== pte_Ptr ret__unsigned;;
(\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
(\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
(CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2);;
(\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) \<acute>pt,\<acute>ret__unsigned_long))))))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> ?G'773 ctSlota capa v va}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsigned = capPTBasePtr_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?G'866 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsigned) [] (do y <- unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap);
y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (\<acute>ret__unsigned :== CALL cap_page_table_cap_get_capPTMappedASID_'proc(capa);;
(\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
(CALL unmapPageTable_'proc(\<acute>ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr ret__unsigned);;
(\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) (pte_Ptr ret__unsigned),\<acute>ret__unsigned_long)))))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> ?G'866 ctSlota capa v va}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?G'1020 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned) [] (do y <- unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap);
y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (\<acute>unsigned_eret_2 :== CALL cap_page_table_cap_get_capPTMappedAddress_'proc(capa);;
(CALL unmapPageTable_'proc(ret__unsigned,\<acute>unsigned_eret_2,pte_Ptr ret__unsignedb);;
(\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) (pte_Ptr ret__unsignedb),\<acute>ret__unsigned_long))))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> ?G'1020 ctSlota capa v va vb}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q732 (cte_Ptr ctSlot) capa) (?G'1154 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned unsigned_eret_2) [] (do y <- unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap);
y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr ret__unsignedb);;
(\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) (pte_Ptr ret__unsignedb),\<acute>ret__unsigned_long)))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?Q732 ctSlota capa a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> ?G'1154 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv xfdca. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa); dc rv xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv) (?Q'1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv xfdca) [] (do y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (\<acute>ret__unsigned_long :== CALL cap_get_capSizeBits_'proc(capa);;
CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) (pte_Ptr ret__unsignedb),\<acute>ret__unsigned_long))
 2. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1264 (cte_Ptr ctSlot) capa\<rbrace> unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap) \<lbrace>?Q1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1257 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned unsigned_eret_2) CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr ret__unsignedb) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> ?Q'1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv (xfdc s)}
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 6. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 8. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 9. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and ?R1264 ctSlota capa) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr va) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> ?R'1257 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv xfdca ret__unsigned_long. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa); dc rv xfdca; ret__unsigned_long = word_of_nat (get_capSizeBits_CL (cap_lift capa))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv) (?G'1304 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv xfdca ret__unsigned_long) [] (do y <- mapM_x (swp storePTE ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (CALL clearMemory_PT_'proc(PTR_COERCE(pte_C \<rightarrow> 32 word) (pte_Ptr ret__unsignedb),ret__unsigned_long))
 2. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1264 (cte_Ptr ctSlot) capa\<rbrace> unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap) \<lbrace>?Q1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1257 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned unsigned_eret_2) CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr ret__unsignedb) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = word_of_nat (get_capSizeBits_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) sa)))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'1304 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv (xfdc s) v}}
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 6. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 8. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 9. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and ?R1264 ctSlota capa) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr va) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> ?R'1257 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (9 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 xfdca ret__unsigned_long. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa); ret__unsigned_long = word_of_nat (get_capSizeBits_CL (cap_lift capa))\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1256 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) (capPTBasePtr_CL (cap_page_table_cap_lift capa)) (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) ()) (?G'1304 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) (capPTBasePtr_CL (cap_page_table_cap_lift capa)) (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) () xfdca (word_of_nat (get_capSizeBits_CL (cap_lift capa)))) [] (do y <- mapM_x (\<lambda>y. setObject y ARM_H.InvalidPTE) [capPTBasePtr cap , capPTBasePtr cap + 2 ^ pteBits .e. capPTBasePtr cap + 2 ^ ptBits - 1];
doMachineOp (cleanCacheRange_PoU (capPTBasePtr cap) (capPTBasePtr cap + 2 ^ ptBits - 1) (addrFromPPtr (capPTBasePtr cap)))
od) (CALL clearMemory_PT_'proc(PTR(32 word) (capPTBasePtr_CL (cap_page_table_cap_lift capa)),word_of_nat (get_capSizeBits_CL (cap_lift capa))))
 2. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1264 (cte_Ptr ctSlot) capa\<rbrace> unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap) \<lbrace>?Q1256 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2\<rbrace>
 3. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1257 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned unsigned_eret_2) CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr ret__unsignedb) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {sa. \<forall>v. v = word_of_nat (get_capSizeBits_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) sa)))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'1304 ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2 rv (xfdc s) v}}
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 6. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 7. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 8. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 9. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and ?R1264 ctSlota capa) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr va) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> ?R'1257 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (8 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R1264 (cte_Ptr ctSlot) capa\<rbrace> unmapPageTable (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa)) (capPTBasePtr cap) \<lbrace>\<lambda>a. page_table_at' (capPTBasePtr cap) and (\<lambda>s. 2 ^ ptBits \<le> gsMaxObjectSize s) and (\<lambda>_. is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))\<rbrace>
 2. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1257 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned unsigned_eret_2) CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr ret__unsignedb) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = word_of_nat (get_capSizeBits_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. bits_'_update (\<lambda>_. v) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) ret__unsignedb\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPTBasePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>bits = word_of_nat ptBits\<rbrace>}}}
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 5. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 7. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 8. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and ?R1264 ctSlota capa) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr va) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> ?R'1257 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1257 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ret__unsignedb ret__unsigned unsigned_eret_2) CALL unmapPageTable_'proc(ret__unsigned,unsigned_eret_2,pte_Ptr ret__unsignedb) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. \<forall>v. v = word_of_nat (get_capSizeBits_CL (cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s)))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. bits_'_update (\<lambda>_. v) (s\<lparr>ptr___ptr_to_unsigned_long_' := PTR(32 word) ret__unsignedb\<rparr>) \<in> UNIV \<inter> \<lbrace>\<acute>ptr___ptr_to_unsigned_long = PTR(32 word) (capPTBasePtr cap)\<rbrace> \<inter> \<lbrace>\<acute>bits = word_of_nat ptBits\<rbrace>}}}
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr va) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> ?R'1257 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>ctSlota capa ret__unsigneda ret__unsignedb ret__unsigned unsigned_eret_2. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigneda = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)); capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0; ret__unsignedb = capPTBasePtr_CL (cap_page_table_cap_lift capa); ret__unsigned = capPTMappedASID_CL (cap_page_table_cap_lift capa); unsigned_eret_2 = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1257 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) (capPTBasePtr_CL (cap_page_table_cap_lift capa)) (capPTMappedASID_CL (cap_page_table_cap_lift capa)) (capPTMappedAddress_CL (cap_page_table_cap_lift capa))) CALL unmapPageTable_'proc(capPTMappedASID_CL (cap_page_table_cap_lift capa),capPTMappedAddress_CL (cap_page_table_cap_lift capa),pte_Ptr (capPTBasePtr_CL (cap_page_table_cap_lift capa))) \<lbrace>capPTBasePtr_CL (cap_page_table_cap_lift capa) = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 4. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>va v'. va = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr va) s \<in> {s. \<forall>vb v'. vb = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := vb\<rparr> \<in> {s. s \<in> {s. \<forall>vc v'. vc = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vc\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr va) (vaddr_'_update (\<lambda>_. vc) (asid_'_update (\<lambda>_. vb) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> ?R'1257 ctSlota capa v va vb vc}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None); \<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa))) [] (case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od) SKIP
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 3. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = 0; capPTMappedAddress cap = None; capPTIsMapped_CL (cap_page_table_cap_lift capa) = 0\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?R731 (cte_Ptr ctSlot) capa) (?T733 (cte_Ptr ctSlot) capa 0) [] (return ()) SKIP
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 3. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> ?R731 ctSlota capa a)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> ?T733 ctSlota capa v)}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 2. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> capPTMappedAddress cap = (if to_bool (capPTIsMapped_CL (cap_page_table_cap_lift capa)) then Some (capPTMappedASID_CL (cap_page_table_cap_lift capa), capPTMappedAddress_CL (cap_page_table_cap_lift capa)) else None)
 2. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned y rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa); dc y rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 ctSlota capa ret__unsigned y) (?Q'714 ctSlota capa ret__unsigned y rv') [SKIP] (do cap <- liftM capCap (getSlotCap ctSlot);
updateCap ctSlot (capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) cap))
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q714 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ()) (?Q'714 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) () rv') [SKIP] (do cte <- getCTE ctSlot;
ctea <- getCTE ctSlot;
setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) (capCap (cteCap cte)))) ctea)
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr ctSlot} (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0));;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>?Q714 ctSlota capa ret__unsigned\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'714 ctSlota capa ret__unsigned)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned rv'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A1438 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) ()) (?C'1435 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) () rv') [SKIP] (do cte <- getCTE ctSlot;
ctea <- getCTE ctSlot;
setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) (capCap (cteCap cte)))) ctea)
od) (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. ?A1438 ctSlota capa ret__unsigned a and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. ?C'1435 ctSlota capa ret__unsigned a b \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned rv' rv rva. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (\<lambda>a. ?P1455 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) () rv a rva) (?P'1453 capa rv' rv rva) [SKIP] (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) (capCap (cteCap rv)))) rva)) (CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>aa. \<forall>cte. ctes_of aa ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of aa ctSlot = Some ctea \<longrightarrow> ?P1455 ctSlota capa ret__unsigned a cte aa ctea)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'a. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte'a \<and> cl_valid_cte cte'a \<longrightarrow> s \<in> ?P'1454 ctSlota capa ret__unsigned a b cte' cte'a}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}
flex-flex pairs:
\<lambda>capa. ?P'1454 (cte_Ptr ctSlot) capa (capPTIsMapped_CL (cap_page_table_cap_lift capa)) () \<equiv>\<^sup>? \<lambda>capa rv' cte' cte'a. ?P'1453 capa rv' (cte_to_H cte') (cte_to_H cte'a) proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned rv' rv rva. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. (cte_wp_at' ((=) rv) ctSlot and (\<lambda>_. rv = rva \<and> isArchCap isPageTableCap (cteCap rv))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} CALL cap_page_table_cap_ptr_set_capPTIsMapped_'proc(cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C'']),0);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) (capCap (cteCap rv)))) rva) \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>ctSlota capa ret__unsigned rv' rv rva \<sigma>. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> {s. (cte_wp_at' ((=) rv) ctSlot and (\<lambda>_. rv = rva \<and> isArchCap isPageTableCap (cteCap rv))) \<sigma> \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. s \<Turnstile>\<^sub>c cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C''] \<and> cap_get_tag (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C''])))) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> (\<forall>t. (\<exists>cap. cap_page_table_cap_lift cap = cap_page_table_cap_lift (cte_C.cap_C (the (cslift s (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))\<lparr>capPTIsMapped_CL := 0 && mask 1\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift s (cparent (cap_Ptr &(cte_Ptr ctSlot\<rightarrow>[''cap_C''])) [''cap_C'']))))) (t_hrs_' (globals s))) \<longrightarrow> (\<exists>(rv, \<sigma>')\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) (capCap (cteCap rv)))) rva) \<sigma>). (\<sigma>', s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>globals := globals s\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>, ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))))}
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; ctes_of \<sigma> ctSlot = Some rva; (\<sigma>, x) \<in> rf_sr; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> (\<forall>t. (\<exists>cap. cap_page_table_cap_lift cap = cap_page_table_cap_lift (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot))))\<lparr>capPTIsMapped_CL := 0\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift x (cte_Ptr ctSlot))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; ctes_of \<sigma> ctSlot = Some rva; (\<sigma>, x) \<in> rf_sr; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> (\<forall>t. (\<exists>cap. cap_page_table_cap_lift cap = cap_page_table_cap_lift (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot))))\<lparr>capPTIsMapped_CL := 0\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift x (cte_Ptr ctSlot))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; ctes_of \<sigma> ctSlot = Some rva; (\<sigma>, x) \<in> rf_sr; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (cteCap rva) (cte_C.cap_C y')\<rbrakk> \<Longrightarrow> x \<Turnstile>\<^sub>c cte_Ptr ctSlot \<and> cap_get_tag (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot)))) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> (\<forall>t. (\<exists>cap. cap_page_table_cap_lift cap = cap_page_table_cap_lift (cte_C.cap_C (the (cslift x (cte_Ptr ctSlot))))\<lparr>capPTIsMapped_CL := 0\<rparr> \<and> cap_get_tag cap = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap \<and> t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. cap) (the (cslift x (cte_Ptr ctSlot))))) (t_hrs_' (globals x))) \<longrightarrow> (\<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := t_hrs_' (globals t)\<rparr>\<rparr>) \<in> rf_sr))
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; (\<sigma>, x) \<in> rf_sr; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; (\<sigma>, x) \<in> rf_sr; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); ((), s') \<in> fst (setCTE ctSlot (?cte1515 capa rva \<sigma> x arch_cap y' t capb) \<sigma>); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> ?cte1515 capa rva \<sigma> x arch_cap y' t capb); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> \<exists>xa\<in>fst (setCTE ctSlot (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) \<sigma>). case xa of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; (\<sigma>, x) \<in> rf_sr; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'\<rbrakk> \<Longrightarrow> case ((), s') of (rv, \<sigma>') \<Rightarrow> (\<sigma>', x\<lparr>globals := globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>\<rparr>) \<in> rf_sr
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace s') (underlying_memory (ksMachineState s')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))) \<and> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cpspace_relation (ksPSpace s') (underlying_memory (ksMachineState s')) (hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)))
 2. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva)) ((cslift x)(cte_Ptr ctSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. capb) y')) cte_Ptr ccte_relation \<and> cmap_relation (map_to_tcbs (ksPSpace s')) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation
 2. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps (ksPSpace s')) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns (ksPSpace s')) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes (ksPSpace s')) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes (ksPSpace s')) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools (ksPSpace s')) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes (ksPSpace s')) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes (ksPSpace s')) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva)) ((cslift x)(cte_Ptr ctSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. capb) y')) cte_Ptr ccte_relation \<and> True \<and> cmap_relation (heap_to_user_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_C) cuser_user_data_relation \<and> cmap_relation (heap_to_device_data (ksPSpace s') (underlying_memory (ksMachineState s'))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation
 2. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (ctes_of \<sigma>) (cslift x) cte_Ptr ccte_relation; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> cmap_relation ((ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva)) ((cslift x)(cte_Ptr ctSlot \<mapsto> cte_C.cap_C_update (\<lambda>_. capb) y')) cte_Ptr ccte_relation
 2. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ccte_relation (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) (cte_C.cap_C_update (\<lambda>_. capb) y')
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> ccte_relation (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) (cte_C.cap_C_update (\<lambda>_. capb) y')
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) = map_option cte_to_H (cte_lift (cte_C.cap_C_update (\<lambda>_. capb) y'))
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (8 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> cte_lift y' = Some (?z1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> cap_lift capb = Some (?capl1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)
 3. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) = Some (cteCap_update (\<lambda>_. cap_to_H (?capl1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)) (cte_to_H (?z1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)))
 4. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 5. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 7. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (8 subgoals):
 1. \<And>capa \<sigma> x arch_cap y' t capb ps vl z. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = Some (cte_to_H z); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) (cte_to_H z)); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; capability.ArchObjectCap arch_cap = cap_to_H (cap_CL z); cte_lift y' = Some z\<rbrakk> \<Longrightarrow> z = ?z1581 capa (cte_to_H z) \<sigma> x arch_cap y' t capb ps vl (cap_CL z)
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> cap_lift capb = Some (?capl1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)
 3. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) = Some (cteCap_update (\<lambda>_. cap_to_H (?capl1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)) (cte_to_H (?z1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)))
 4. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 5. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 7. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 8. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (7 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> cap_lift capb = Some (?capl1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) = Some (cteCap_update (\<lambda>_. cap_to_H (?capl1581 capa rva \<sigma> x arch_cap y' t capb ps vl vla)) (cte_to_H (the (cte_lift y'))))
 3. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 4. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 6. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 7. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (6 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps vl vla. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; cteCap rva = cap_to_H vla; cap_get_tag (cte_C.cap_C y') = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ctes_of \<sigma> ctSlot = map_option cte_to_H (cte_lift y'); Some rva = map_option cte_to_H (cte_lift y'); cslift x (cte_Ptr ctSlot) = Some y'; cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr; cap_lift capa = Some vl; capability.ArchObjectCap cap = cap_to_H vl; cap_lift (cte_C.cap_C y') = Some vla; capability.ArchObjectCap arch_cap = cap_to_H vla\<rbrakk> \<Longrightarrow> Some (cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva) = Some (cteCap_update (\<lambda>_. cap_to_H (Cap_page_table_cap (cap_page_table_cap_lift capb))) (cte_to_H (the (cte_lift y'))))
 2. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 3. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 5. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 6. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (5 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb ps. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); map_to_ctes ps = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps ps; map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns ps; map_to_pdes (ksPSpace \<sigma>) = map_to_pdes ps; map_to_ptes (ksPSpace \<sigma>) = map_to_ptes ps; map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools ps; map_to_user_data (ksPSpace \<sigma>) = map_to_user_data ps; map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device ps; map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs ps; \<forall>T p. typ_at' T p \<sigma> = typ_at' T p (\<sigma>\<lparr>ksPSpace := ps\<rparr>); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>; cmap_relation (map_to_tcbs (ksPSpace \<sigma>)) (cslift x) tcb_ptr_to_ctcb_ptr ctcb_relation; cmap_relation (map_to_eps ps) (cslift x) ep_Ptr (cendpoint_relation (cslift x)); cmap_relation (map_to_ntfns ps) (cslift x) ntfn_Ptr (cnotification_relation (cslift x)); cmap_relation (map_to_pdes ps) (cslift x) pde_Ptr cpde_relation; cmap_relation (map_to_ptes ps) (cslift x) pte_Ptr cpte_relation; cmap_relation (map_to_asidpools ps) (cslift x) ap_Ptr casid_pool_relation; cmap_relation (heap_to_user_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_C) cuser_user_data_relation; cmap_relation (heap_to_device_data ps (underlying_memory (ksMachineState \<sigma>))) (cslift x) PTR(user_data_device_C) cuser_user_data_device_relation; carray_map_relation pdBits (map_to_pdes ps) (c_h_t_valid x) pd_Ptr; carray_map_relation ptBits (map_to_ptes ps) (c_h_t_valid x) pt_Ptr\<rbrakk> \<Longrightarrow> inj cte_Ptr
 2. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 4. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 5. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (4 subgoals):
 1. \<And>capa rva \<sigma> x arch_cap y' t capb s'. \<lbrakk>isPageTableCap cap; ccap_relation (capability.ArchObjectCap cap) capa; cteCap rva = capability.ArchObjectCap arch_cap; isPageTableCap arch_cap; ctes_of \<sigma> ctSlot = Some rva; ccte_relation rva y'; cslift x (cte_Ptr ctSlot) = Some y'; ccap_relation (capability.ArchObjectCap arch_cap) (cte_C.cap_C y'); cap_page_table_cap_lift capb = cap_page_table_cap_lift (cte_C.cap_C y')\<lparr>capPTIsMapped_CL := 0\<rparr>; cap_get_tag capb = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; t_hrs_' (globals t) = hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x)); s' = \<sigma>\<lparr>ksPSpace := ksPSpace s'\<rparr>; ctes_of s' = (ctes_of \<sigma>)(ctSlot \<mapsto> cteCap_update (\<lambda>_. capability.ArchObjectCap (capPTMappedAddress_update (\<lambda>_. None) arch_cap)) rva); map_to_eps (ksPSpace \<sigma>) = map_to_eps (ksPSpace s'); map_to_ntfns (ksPSpace \<sigma>) = map_to_ntfns (ksPSpace s'); map_to_pdes (ksPSpace \<sigma>) = map_to_pdes (ksPSpace s'); map_to_ptes (ksPSpace \<sigma>) = map_to_ptes (ksPSpace s'); map_to_asidpools (ksPSpace \<sigma>) = map_to_asidpools (ksPSpace s'); map_to_user_data (ksPSpace \<sigma>) = map_to_user_data (ksPSpace s'); map_to_user_data_device (ksPSpace \<sigma>) = map_to_user_data_device (ksPSpace s'); map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace \<sigma>) = map_option tcb_no_ctes_proj \<circ> map_to_tcbs (ksPSpace s'); \<forall>T p. typ_at' T p \<sigma> = typ_at' T p s'; cpspace_relation (ksPSpace \<sigma>) (underlying_memory (ksMachineState \<sigma>)) (t_hrs_' (globals x)); cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues \<sigma>); zero_ranges_are_zero (gsUntypedZeroRanges \<sigma>) (t_hrs_' (globals x)); cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap \<sigma>); cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap \<sigma>); ksCurThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksCurThread \<sigma>); ksIdleThread_' (globals x) = tcb_ptr_to_ctcb_ptr (ksIdleThread \<sigma>); cinterrupt_relation (ksInterruptState \<sigma>) intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)); cscheduler_action_relation (ksSchedulerAction \<sigma>) (ksSchedulerAction_' (globals x)); carch_state_relation (ksArchState \<sigma>) (globals x); cmachine_state_relation (ksMachineState \<sigma>) (globals x); cte_array_relation \<sigma> (globals x); tcb_cte_array_relation \<sigma> (globals x); apsnd fst (ghost'state_' (globals x)) = (gsUserPages \<sigma>, gsCNodes \<sigma>); ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize \<sigma>); ksWorkUnitsCompleted_' (globals x) = ksWorkUnitsCompleted \<sigma>; x \<Turnstile>\<^sub>c intStateIRQNode_array_Ptr; {symbol_table ''intStateIRQNode''..+256 * size_of TYPE(cte_C)} \<subseteq> kernel_data_refs; x \<Turnstile>\<^sub>c armKSGlobalPD_Ptr; {symbol_table ''armKSGlobalPD''..+16384} \<subseteq> kernel_data_refs; htd_safe domain (hrs_htd (t_hrs_' (globals x))); - domain \<subseteq> kernel_data_refs; globals_list_distinct (- kernel_data_refs) symbol_table kernel_all_global_addresses.global_data_list; cdom_schedule_relation (kernel_state.ksDomSchedule \<sigma>) kernel_all_global_addresses.ksDomSchedule; ksDomScheduleIdx_' (globals x) = word_of_nat (ksDomScheduleIdx \<sigma>); ksCurDomain_' (globals x) = UCAST(8 \<rightarrow> 32) (ksCurDomain \<sigma>); ksDomainTime_' (globals x) = ksDomainTime \<sigma>\<rbrakk> \<Longrightarrow> cready_queues_relation (cslift x) (ksReadyQueues_' (globals x)) (ksReadyQueues s') \<and> zero_ranges_are_zero (gsUntypedZeroRanges s') (t_hrs_' (globals x)) \<and> cbitmap_L1_relation (ksReadyQueuesL1Bitmap_' (globals x)) (ksReadyQueuesL1Bitmap s') \<and> cbitmap_L2_relation (ksReadyQueuesL2Bitmap_' (globals x)) (ksReadyQueuesL2Bitmap s') \<and> ksCurThread \<sigma> = ksCurThread s' \<and> ksIdleThread \<sigma> = ksIdleThread s' \<and> cinterrupt_relation (ksInterruptState s') intStateIRQNode_array_Ptr (intStateIRQTable_' (globals x)) \<and> cscheduler_action_relation (ksSchedulerAction s') (ksSchedulerAction_' (globals x)) \<and> carch_state_relation (ksArchState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cmachine_state_relation (ksMachineState s') (globals x\<lparr>t_hrs_' := hrs_mem_update (heap_update (cte_Ptr ctSlot) (cte_C.cap_C_update (\<lambda>_. capb) y')) (t_hrs_' (globals x))\<rparr>) \<and> cte_array_relation s' (globals x) \<and> tcb_cte_array_relation s' (globals x) \<and> gsUserPages \<sigma> = gsUserPages s' \<and> gsCNodes \<sigma> = gsCNodes s' \<and> ghost_size_rel (ghost'state_' (globals x)) (gsMaxObjectSize s') \<and> ksWorkUnitsCompleted \<sigma> = ksWorkUnitsCompleted s' \<and> cdom_schedule_relation (kernel_state.ksDomSchedule s') kernel_all_global_addresses.ksDomSchedule \<and> word_of_nat (ksDomScheduleIdx \<sigma>) = word_of_nat (ksDomScheduleIdx s') \<and> ksCurDomain \<sigma> = ksCurDomain s' \<and> ksDomainTime \<sigma> = ksDomainTime s'
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 3. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 4. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (3 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a. (\<lambda>a. \<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> (\<forall>ctea. ctes_of a ctSlot = Some ctea \<longrightarrow> (cte_wp_at' ((=) cte) ctSlot and (\<lambda>_. cte = ctea \<and> isArchCap isPageTableCap (cteCap cte))) a)) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlota)\<rbrace>
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (3 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> \<lbrace>?R719 (cte_Ptr ctSlot) capa\<rbrace> case capPTMappedAddress cap of None \<Rightarrow> return () | Some a \<Rightarrow> case a of (asid, vaddr) \<Rightarrow> do unmapPageTable asid vaddr (capPTBasePtr cap);
ptr <- return (capPTBasePtr cap);
slots <- return [ptr , ptr + HaskellLib_H.bit pteBits .e. ptr + HaskellLib_H.bit ptBits - 1];
mapM_x (swp storePTE ARM_H.InvalidPTE) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ ptr) (VPtr $ fromPPtr $ ptr + HaskellLib_H.bit ptBits - 1) (addrFromPPtr ptr)
od \<lbrace>\<lambda>a b. (\<forall>cte. ctes_of b ctSlot = Some cte \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (\<exists>cte. ctes_of b ctSlot = Some cte)\<rbrace>
 2. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> {s. \<forall>cte'. (cte_lift \<circ>\<^sub>m cslift s) ctSlota = Some cte' \<and> cl_valid_cte cte' \<longrightarrow> s \<in> UNIV}} \<inter> \<lbrace>True\<rbrace>)
 3. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and ?R719 ctSlota capa) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (2 subgoals):
 1. \<And>ctSlota capa ret__unsigned. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; ret__unsigned = capPTIsMapped_CL (cap_page_table_cap_lift capa)\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>a b. UNIV)
 2. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and (\<lambda>a. (capPTMappedAddress cap = None \<longrightarrow> (\<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (\<exists>cte. ctes_of a ctSlot = Some cte)) \<and> (\<forall>x. capPTMappedAddress cap = Some x \<longrightarrow> (case x of (a, b) \<Rightarrow> \<lambda>a. (\<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (\<exists>cte. ctes_of a ctSlot = Some cte)) a))) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (1 subgoal):
 1. \<And>ctSlota capa s s'. \<lbrakk>isPageTableCap cap; ctSlota = cte_Ptr ctSlot; ccap_relation (capability.ArchObjectCap cap) capa; (s, s') \<in> rf_sr; (invs' and cte_wp_at' ((=) (capability.ArchObjectCap cap) \<circ> cteCap) ctSlot) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> (invs' and (\<lambda>s. capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase) and (\<lambda>a. page_table_at' (capPTBasePtr cap) a \<and> 2 ^ ptBits \<le> gsMaxObjectSize a \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0 \<and> addrFromPPtr (capPTBasePtr cap) = addrFromPPtr (capPTBasePtr cap))) a) \<and> (\<not> capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> True)) and (\<lambda>a. (capPTMappedAddress cap = None \<longrightarrow> (\<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (\<exists>cte. ctes_of a ctSlot = Some cte)) \<and> (\<forall>x. capPTMappedAddress cap = Some x \<longrightarrow> (case x of (a, b) \<Rightarrow> \<lambda>a. (\<forall>cte. ctes_of a ctSlot = Some cte \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (\<exists>cte. ctes_of a ctSlot = Some cte)) a))) s \<and> s' \<in> {s. \<forall>v v'. v = capPTIsMapped_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. (v \<noteq> 0 \<longrightarrow> s \<in> {s. \<forall>v v'. v = capPTBasePtr_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := v\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>_. pte_Ptr v) s \<in> {s. \<forall>va v'. va = capPTMappedASID_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>ret__unsigned_' := va\<rparr> \<in> {s. s \<in> {s. \<forall>vb v'. vb = capPTMappedAddress_CL (cap_page_table_cap_lift (cap_' (cap_'_update (\<lambda>_. capa) s))) \<longrightarrow> s\<lparr>unsigned_eret_2_' := vb\<rparr> \<in> {s. s \<in> {s. pt_'_update (\<lambda>x. pte_Ptr v) (vaddr_'_update (\<lambda>_. vb) (asid_'_update (\<lambda>_. va) s)) \<in> UNIV \<inter> \<lbrace>\<acute>asid = capPTMappedASID_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>vaddr = capPTMappedAddress_CL (cap_page_table_cap_lift capa)\<rbrace> \<inter> \<lbrace>\<acute>pt = pte_Ptr (capPTBasePtr cap)\<rbrace>} \<inter> \<lbrace>v = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits\<rbrace>}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap}) \<and> (\<not> v \<noteq> 0 \<longrightarrow> s \<in> UNIV \<inter> {s. dc () (xfdc s)})}}} \<inter> {s. cap_get_tag (cap_' (cap_'_update (\<lambda>_. capa) s)) = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap} proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ccap_relation (cteCap cte) capa; (s, s') \<in> rf_sr; invs' s; ctes_of s ctSlot = Some cte; capability.ArchObjectCap cap = cteCap cte\<rbrakk> \<Longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase \<and> page_table_at' (capPTBasePtr cap) s \<and> 2 ^ ptBits \<le> gsMaxObjectSize s \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0) \<and> (capPTMappedAddress cap = None \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> ((\<exists>a b. capPTMappedAddress cap = Some (a, b)) \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> capPTBasePtr_CL (cap_page_table_cap_lift capa) = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ccap_relation (cteCap cte) capa; (s, s') \<in> rf_sr; invs' s; ctes_of s ctSlot = Some cte; capability.ArchObjectCap cap = cteCap cte; valid_cap' (cteCap cte) s\<rbrakk> \<Longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase \<and> page_table_at' (capPTBasePtr cap) s \<and> 2 ^ ptBits \<le> gsMaxObjectSize s \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0) \<and> (capPTMappedAddress cap = None \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> ((\<exists>a b. capPTMappedAddress cap = Some (a, b)) \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> capPTBasePtr_CL (cap_page_table_cap_lift capa) = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; ccap_relation (cteCap cte) capa; (s, s') \<in> rf_sr; invs' s; ctes_of s ctSlot = Some cte; capability.ArchObjectCap cap = cteCap cte; valid_cap' (cteCap cte) s; kernel_data_refs \<inter> capRange (cteCap cte) = {} \<and> global_refs' s \<subseteq> kernel_data_refs \<and> 2 ^ capBits (cteCap cte) \<le> gsMaxObjectSize s\<rbrakk> \<Longrightarrow> (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> capPTMappedASID_CL (cap_page_table_cap_lift capa) \<le> mask local.asid_bits \<and> capPTMappedAddress_CL (cap_page_table_cap_lift capa) < pptrBase \<and> page_table_at' (capPTBasePtr cap) s \<and> 2 ^ ptBits \<le> gsMaxObjectSize s \<and> is_aligned (capPTBasePtr cap) ptBits \<and> capPTBasePtr cap \<noteq> 0) \<and> (capPTMappedAddress cap = None \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> ((\<exists>a b. capPTMappedAddress cap = Some (a, b)) \<longrightarrow> isArchCap isPageTableCap (cteCap cte)) \<and> (capPTIsMapped_CL (cap_page_table_cap_lift capa) \<noteq> 0 \<longrightarrow> capPTBasePtr_CL (cap_page_table_cap_lift capa) = capPTBasePtr cap \<and> word_of_nat (get_capSizeBits_CL (cap_lift capa)) = word_of_nat ptBits) proof (prove)
goal (1 subgoal):
 1. \<And>capa s s' cte. \<lbrakk>cap_get_tag capa = SCAST(32 signed \<rightarrow> 32) cap_page_table_cap; (s, s') \<in> rf_sr; invs' s; ctes_of s ctSlot = Some cte; cap = arch_capability.PageTableCap 0 (Some ((cap_C.words_C capa.[Suc 0] >> 12) && 0x1FFFF, (cap_C.words_C capa.[Suc 0] << 20) && 0xFFF00000)); cteCap cte = capability.ArchObjectCap (arch_capability.PageTableCap 0 (Some ((cap_C.words_C capa.[Suc 0] >> 12) && 0x1FFFF, (cap_C.words_C capa.[Suc 0] << 20) && 0xFFF00000))); kernel_data_refs \<inter> {0..0x3FF} = {}; 10 < word_bits; global_refs' s \<subseteq> kernel_data_refs; 1024 \<le> gsMaxObjectSize s; \<forall>y<0x100. pte_at' (y << 2) s; (cap_C.words_C capa.[Suc 0] >> 29) && 1 = 1; 0 < (cap_C.words_C capa.[Suc 0] >> 12) && 0x1FFFF; (cap_C.words_C capa.[Suc 0] >> 12) && 0x1FFFF < 2 ^ local.asid_bits; (cap_C.words_C capa.[Suc 0] << 20) && 0xFFF00000 < pptrBase; cap_C.words_C capa.[0] && 0xFFFFFC00 = 0\<rbrakk> \<Longrightarrow> False proof (prove)
goal:
No subgoals!