theory ArchSyscall_IF

lemma decode_arch_invocation_authorised_for_globals[Syscall_IF_assms]:
  "\<lbrace>invs and cte_wp_at ((=) (ArchObjectCap cap)) slot
         and (\<lambda>s. \<forall>(cap, slot) \<in> set excaps. cte_wp_at ((=) cap) slot s)\<rbrace>
   arch_decode_invocation label msg x_slot slot cap excaps
   \<lbrace>authorised_for_globals_arch_inv\<rbrace>, -" unfolding arch_decode_invocation_def authorised_for_globals_arch_inv_def apply (rule hoare_pre) apply (simp add: split_def Let_def
               cong: cap.case_cong arch_cap.case_cong if_cong option.case_cong
               split del: if_split) apply (wp select_ext_weak_wp whenE_throwError_wp check_vp_wpR unlessE_wp get_pde_wp
             get_master_pde_wp find_pd_for_asid_authority3 create_mapping_entries_parent_for_refs
          | wpc
          | simp add: authorised_for_globals_page_inv_def
                 del: hoare_True_E_R)+ apply (simp cong: if_cong) apply (wp hoare_vcg_if_lift2) apply (rule hoare_conjI) apply (rule hoare_drop_imps) apply (simp add: authorised_for_globals_page_table_inv_def) apply wp apply (rule hoare_drop_imps) apply wp apply ((wp hoare_TrueI hoare_vcg_all_lift hoare_drop_imps | wpc | simp)+)[3] apply (clarsimp simp: authorised_asid_pool_inv_def authorised_page_table_inv_def
                        neq_Nil_conv invs_psp_aligned invs_vspace_objs cli_no_irqs) apply (drule cte_wp_valid_cap, clarsimp+) apply (cases cap, simp_all)
    \<comment> \<open>PageCap\<close> apply (clarsimp simp: valid_cap_simps cli_no_irqs) apply (cases "invocation_type label";
           (rename_tac arch, case_tac arch; simp add: isPageFlushLabel_def isPDFlushLabel_def))
          \<comment> \<open>Map\<close> apply (rename_tac word cap_rights vmpage_size option arch) apply (clarsimp simp: isPageFlushLabel_def isPDFlushLabel_def | rule conjI)+ apply (drule cte_wp_valid_cap) apply (clarsimp simp: invs_def valid_state_def) apply (simp add: valid_cap_def) apply (simp add: vmsz_aligned_def) apply (drule_tac ptr="msg ! 0" and off="2 ^ pageBitsForSize vmpage_size - 1"
                         in is_aligned_no_wrap') apply (insert pbfs_less_wb') apply (clarsimp) apply (fastforce simp: x_power_minus_1) apply (clarsimp) apply (fastforce dest: cte_wp_valid_cap simp: invs_def valid_state_def valid_cap_def)
         \<comment> \<open>Unmap\<close> apply (simp add: authorised_for_globals_page_inv_def)+ apply (clarsimp)
   \<comment> \<open>PageTableCap\<close> apply (clarsimp simp: authorised_for_globals_page_table_inv_def) apply (frule_tac vptr="msg ! 0" in pd_shifting') apply (clarsimp simp: invs_def valid_state_def valid_global_refs_def valid_refs_def global_refs_def) apply (erule_tac x=aa in allE) apply (erule_tac x=b in allE) apply (drule_tac P'="\<lambda>c. idle_thread s \<in> cap_range c
                          \<or> arm_global_pd (arch_state s) \<in> cap_range c
                          \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s)))
                             \<inter> cap_range c \<noteq> {}" in cte_wp_at_weakenE) apply (auto simp: cap_range_def) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)\<rbrace> arch_decode_invocation label msg x_slot slot cap excaps \<lbrace>authorised_for_globals_arch_inv\<rbrace>, - proof (prove)
goal (1 subgoal):
 1. \<lbrace>invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)\<rbrace> case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of base));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length msg \<and> 1 < length excaps then let index = msg ! 0; depth = msg ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; rights_mask = msg ! 1; attr = msg ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some a \<Rightarrow> returnOk a;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; attr = msg ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
frame_info <- liftE $ resolve_vaddr pd start;
case frame_info of None \<Rightarrow> returnOk $ InvokePageDirectory PageDirectoryNothing | Some (frame_size, frame_base) \<Rightarrow> let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, - proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'\<rbrace> case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of base));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length msg \<and> 1 < length excaps then let index = msg ! 0; depth = msg ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; rights_mask = msg ! 1; attr = msg ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some a \<Rightarrow> returnOk a;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length msg \<and> 0 < length excaps then let vaddr = msg ! 0; attr = msg ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length msg then let start = msg ! 0; end = msg ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
frame_info <- liftE $ resolve_vaddr pd start;
case frame_info of None \<Rightarrow> returnOk $ InvokePageDirectory PageDirectoryNothing | Some (frame_size, frame_base) \<Rightarrow> let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 2. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> ?P' s proof (prove)
goal (2 subgoals):
 1. \<lbrace>?P'\<rbrace> case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if excaps \<noteq> [] then case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE (gets (arm_asid_table \<circ> arch_state));
y <- whenE (asid_table (asid_high_bits_of base) = None) (throwError (FailedLookup False InvalidRoot));
y <- whenE (p \<noteq> the (asid_table (asid_high_bits_of base))) (throwError (InvalidCapability 0));
pool <- liftE (get_asid_pool p);
y <- whenE (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0} = {}) (throwError DeleteFirst);
offset <- liftE (select_ext (\<lambda>_. free_asid_pool_select pool base) (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0}));
returnOk (InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) offset + base) p (snd (excaps ! 0))))
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError (InvalidCapability (Suc 0)) | ArchObjectCap _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if Suc 0 < length msg \<and> Suc 0 < length excaps then doE asid_table <- liftE (gets (arm_asid_table \<circ> arch_state));
y <- whenE (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} = {}) (throwError DeleteFirst);
free <- liftE (select_ext (\<lambda>_. free_asid_select asid_table) (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}));
p <- case fst (excaps ! 0) of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0));
frame <- if snd p = pageBits then doE y <- ensure_no_children (snd (excaps ! 0));
returnOk (fst p)
odE else throwError (InvalidCapability (Suc 0));
dest_slot <- lookup_slot_for_cnode_op False (fst (excaps ! Suc 0)) (to_bl (msg ! 0)) (unat (msg ! Suc 0));
y <- ensure_empty dest_slot;
returnOk (InvokeASIDControl (MakePool frame dest_slot (snd (excaps ! 0)) (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits)))
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length msg \<and> excaps \<noteq> [] then doE pa <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError (InvalidCapability (Suc 0)) | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0));
y <- case mapped_address of None \<Rightarrow> whenE (kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize pgsz - 1) (throwError (InvalidArgument 0)) | Some a \<Rightarrow> doE y <- whenE (fst a \<noteq> snd pa) (throwError (InvalidCapability (Suc 0)));
whenE (snd a \<noteq> msg ! 0) (throwError (InvalidArgument 0))
odE;
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd pa));
y <- whenE (pd' \<noteq> fst pa) (throwError (InvalidCapability (Suc 0)));
y <- check_vp_alignment pgsz (msg ! 0);
entries <- create_mapping_entries (addrFromPPtr p) (msg ! 0) pgsz (mask_vm_rights R (data_to_rights (msg ! Suc 0))) (attribs_from_word (msg ! 2)) (fst pa);
y <- ensure_safe_mapping entries;
returnOk (InvokePage (PageMap (snd pa) (ArchObjectCap (PageCap dev p R pgsz (Some (snd pa, msg ! 0)))) slot entries))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk (InvokePage (PageUnmap (PageCap dev p R pgsz mapped_address) slot)) else if isPageFlushLabel (invocation_type label) then if Suc 0 < length msg then doE pa <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some x2 \<Rightarrow> returnOk x2;
pd <- lookup_error_on_failure False (find_pd_for_asid (fst pa));
y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (2 ^ pageBitsForSize pgsz \<le> msg ! 0 \<or> 2 ^ pageBitsForSize pgsz < msg ! Suc 0) (throwError (InvalidArgument 0));
returnOk (InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd pa) (msg ! Suc 0 + snd pa - 1) (addrFromPPtr p + msg ! 0) pd (fst pa)))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk (InvokePage (PageGetAddr p)) else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if Suc 0 < length msg \<and> excaps \<noteq> [] then doE y <- whenE (\<exists>a b. mapped_address = Some (a, b)) (throwError (InvalidCapability 0));
pa <- case fst (excaps ! 0) of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError (InvalidCapability (Suc 0)) | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError (InvalidCapability (Suc 0)) | _ \<Rightarrow> throwError (InvalidCapability (Suc 0));
y <- whenE (kernel_base \<le> msg ! 0) (throwError (InvalidArgument 0));
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd pa));
y <- whenE (pd' \<noteq> fst pa) (throwError (InvalidCapability (Suc 0)));
oldpde <- liftE (get_master_pde (fst pa + (msg ! 0 >> 20 << 2)));
y <- unlessE (oldpde = InvalidPDE) (throwError DeleteFirst);
returnOk (InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap p (Some (snd pa, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr p) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst pa + (msg ! 0 >> 20 << 2))))
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE (is_final_cap (ArchObjectCap (PageTableCap p mapped_address)));
y <- unlessE final (throwError RevokeFirst);
returnOk (InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap p mapped_address)) slot))
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case xa of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 2. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> ?P' s proof (prove)
goal (4 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>final. if final then case InvokePageTable (PageTableUnmap (ArchObjectCap (PageTableCap x41 x42)) slot) of InvokePageTable x \<Rightarrow> authorised_for_globals_page_table_inv x | InvokePage x \<Rightarrow> authorised_for_globals_page_inv x | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> ?P'938 x xa s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>final. if final then authorised_for_globals_page_table_inv (PageTableUnmap (ArchObjectCap (PageTableCap x41 x42)) slot) else (\<lambda>s. True)\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> ?P'938 x xa s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>final s. (final \<longrightarrow> authorised_for_globals_page_table_inv (PageTableUnmap (ArchObjectCap (PageTableCap x41 x42)) slot) s) \<and> (\<not> final \<longrightarrow> True)\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> ?P'938 x xa s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (5 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>r s. r \<longrightarrow> authorised_for_globals_page_table_inv (PageTableUnmap (ArchObjectCap (PageTableCap x41 x42)) slot) s\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>r s. \<not> r \<longrightarrow> True\<rbrace>
 3. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 5. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> ?P'938 x xa s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (5 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>rv. authorised_for_globals_page_table_inv (PageTableUnmap (ArchObjectCap (PageTableCap x41 x42)) slot)\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>r s. \<not> r \<longrightarrow> True\<rbrace>
 3. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 5. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> ?P'938 x xa s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (5 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>rv s. True\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?P'938 x41 x42\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>r s. \<not> r \<longrightarrow> True\<rbrace>
 3. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 5. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> ?P'938 x xa s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>r s. \<not> r \<longrightarrow> True\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> True) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (4 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> is_final_cap (ArchObjectCap (PageTableCap x41 x42)) \<lbrace>\<lambda>rv s. True\<rbrace>
 2. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 3. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 4. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> True) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (3 subgoals):
 1. \<And>x41 x42. \<lbrakk>cap = PageTableCap x41 x42; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> \<lbrace>?R929 x41 x42\<rbrace> throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 2. \<And>x51 x52. cap = PageDirectoryCap x51 x52 \<Longrightarrow> \<lbrace>?R105 x51 x52\<rbrace> if isPDFlushLabel (invocation_type label) then if Suc 0 < length msg then doE y <- whenE (msg ! Suc 0 \<le> msg ! 0) (throwError (InvalidArgument (Suc 0)));
y <- whenE (kernel_base \<le> msg ! 0 \<or> kernel_base < msg ! Suc 0) (throwError IllegalOperation);
p <- case x52 of None \<Rightarrow> throwError (InvalidCapability 0) | Some asid \<Rightarrow> returnOk (x51, asid);
pd' <- lookup_error_on_failure False (find_pd_for_asid (snd p));
y <- whenE (pd' \<noteq> fst p) (throwError (InvalidCapability 0));
liftE (resolve_vaddr (fst p) (msg ! 0)) >>=E case_option (returnOk (InvokePageDirectory PageDirectoryNothing)) (\<lambda>a. doE y <- whenE (page_base (msg ! 0) (fst a) \<noteq> page_base (msg ! Suc 0 - 1) (fst a)) (throwError (RangeError (msg ! 0) (page_base (msg ! 0) (fst a) + mask (pageBitsForSize (fst a)))));
returnOk (InvokePageDirectory (PageDirectoryFlush (label_to_flush_type (invocation_type label)) (msg ! 0) (msg ! Suc 0 - 1) (snd a + (msg ! 0 && mask (pageBitsForSize (fst a)))) (fst p) (snd p)))
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation \<lbrace>\<lambda>ai. case ai of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True\<rbrace>, -
 3. \<And>s. (invs and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s)) s \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> (excaps \<noteq> [] \<longrightarrow> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xb. fst (excaps ! 0) = ArchObjectCap xb \<longrightarrow> (\<forall>x xa. xb = ASIDPoolCap x xa \<longrightarrow> True) \<and> (xb = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xa xc xd xe. xb = PageCap x xa xc xd xe \<longrightarrow> True) \<and> (\<forall>x xa. xb = PageTableCap x xa \<longrightarrow> True) \<and> (\<forall>xc xd. xb = PageDirectoryCap xc xd \<longrightarrow> (xd = None \<longrightarrow> True \<and> ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa) \<noteq> None \<longrightarrow> \<not> x \<noteq> the ((arm_asid_table \<circ> arch_state) s (asid_high_bits_of xa)) \<longrightarrow> True \<and> (\<forall>pool. ako_at (ASIDPool pool) x s \<longrightarrow> - dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0} \<noteq> {} \<longrightarrow> True \<and> (\<forall>xb\<in>- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + xa \<noteq> 0}. (case InvokeASIDPool (Assign (UCAST(10 \<rightarrow> 32) xb + xa) x (snd (excaps ! 0))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s)))) \<and> (\<forall>x. xd = Some x \<longrightarrow> True)))) \<and> (\<not> excaps \<noteq> [] \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> True)) \<and> (cap = ASIDControlCap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> (Suc 0 < length msg \<and> Suc 0 < length excaps \<longrightarrow> True \<and> (- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> True \<and> (\<forall>x\<in>- dom ((arm_asid_table \<circ> arch_state) s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1}. True \<and> True \<and> True \<and> True \<and> True))) \<and> (\<not> (Suc 0 < length msg \<and> Suc 0 < length excaps) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> True)) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> (2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> True \<and> True \<and> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = ASIDPoolCap xa xb \<longrightarrow> True) \<and> (x = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>xa xb xc xd xe. x = PageCap xa xb xc xd xe \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageTableCap xa xb \<longrightarrow> True) \<and> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (xb = None \<longrightarrow> True) \<and> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))) \<and> (\<forall>xb. xd = Some xb \<longrightarrow> \<not> fst xb \<noteq> snd (xa, x) \<longrightarrow> \<not> snd xb \<noteq> msg ! 0 \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xa, x) \<longrightarrow> True \<and> (vmsz_aligned (msg ! 0) xc \<longrightarrow> True \<and> True \<and> (invs and (\<lambda>s. \<exists>ref. (ref \<rhd> fst (xa, x)) s) and typ_at (AArch APageDirectory) (fst (xa, x)) and K (is_aligned (fst (xa, x)) pd_bits) and K (vmsz_aligned (msg ! 0) xc) and K (msg ! 0 < kernel_base)) s))))))) \<and> (\<not> (2 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> (case InvokePage (PageUnmap (PageCap x xa xb xc xd) slot) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> (Suc 0 < length msg \<longrightarrow> True \<and> True \<and> (xd = None \<longrightarrow> True) \<and> (\<forall>x. xd = Some x \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> (2 ^ pageBitsForSize xc \<le> msg ! 0 \<or> 2 ^ pageBitsForSize xc < msg ! Suc 0) \<longrightarrow> (case InvokePage (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + snd x) (msg ! Suc 0 + snd x - 1) (addrFromPPtr xa + msg ! 0) pd (fst x)) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s))) \<and> (\<not> Suc 0 < length msg \<longrightarrow> True)) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> (case InvokePage (PageGetAddr xa) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageGetAddress \<longrightarrow> True))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> (Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<nexists>a b. xa = Some (a, b)) \<longrightarrow> True \<and> (fst (excaps ! 0) = NullCap \<longrightarrow> True) \<and> (\<forall>x xa xb xc. fst (excaps ! 0) = UntypedCap x xa xb xc \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = EndpointCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = NotificationCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = ReplyCap x xa xb \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = CNodeCap x xa xb \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = ThreadCap x \<longrightarrow> True) \<and> (fst (excaps ! 0) = DomainCap \<longrightarrow> True) \<and> (fst (excaps ! 0) = IRQControlCap \<longrightarrow> True) \<and> (\<forall>x. fst (excaps ! 0) = IRQHandlerCap x \<longrightarrow> True) \<and> (\<forall>x xa xb. fst (excaps ! 0) = Zombie x xa xb \<longrightarrow> True) \<and> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>x xb. xa = ASIDPoolCap x xb \<longrightarrow> True) \<and> (xa = ASIDControlCap \<longrightarrow> True) \<and> (\<forall>x xb xc xd xe. xa = PageCap x xb xc xd xe \<longrightarrow> True) \<and> (\<forall>x xb. xa = PageTableCap x xb \<longrightarrow> True) \<and> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (xc = None \<longrightarrow> True) \<and> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> True \<and> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> pd \<noteq> fst (xb, xa) \<longrightarrow> True \<and> (\<forall>pd. ako_at (PageDirectory pd) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> (if (case pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE then case InvokePageTable (PageTableMap (ArchObjectCap (PageTableCap x (Some (snd (xb, xa), msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (fst (xb, xa) + (msg ! 0 >> 20 << 2))) of InvokePageTable oper \<Rightarrow> authorised_for_globals_page_table_inv oper | InvokePage oper \<Rightarrow> authorised_for_globals_page_inv oper | _ \<Rightarrow> \<lambda>_. True else (\<lambda>s. True \<and> True)) s)))))) \<and> (\<not> (Suc 0 < length msg \<and> excaps \<noteq> []) \<longrightarrow> True)) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> True \<and> True) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> ?R929 x xa s))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> ?R105 x xa s) proof (prove)
goal (1 subgoal):
 1. \<And>s. invs s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<Longrightarrow> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xa pd_bits) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base) \<and> (xd = Some (x, msg ! 0) \<longrightarrow> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xa pd_bits) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> is_aligned xa pd_bits \<and> msg ! 0 < kernel_base))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x xa xb xc xd) slot) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. xd = Some (a, b) \<longrightarrow> (\<forall>pd. (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned pd pd_bits) \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize xc \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize xc < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr xa + msg ! 0) pd a) s))) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> authorised_for_globals_page_inv (PageGetAddr xa) s)))) \<and> (\<forall>x. cap = PageTableCap x None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> excaps \<noteq> [] \<longrightarrow> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xb pd_bits) \<and> (\<exists>ref. (ref \<rhd> xb) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xb + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xb + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x (Some (xa, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xb + (msg ! 0 >> 20 << 2))) s))))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x xa s \<and> ?P1382 x xa s \<and> ?P1384 x xa s \<and> ?P1386 x xa s \<and> ?P1388 x xa s \<and> ?P1390 x xa s \<and> ?P1392 x xa s \<and> (\<forall>xb xc. ?P1396 x xa xb xc s)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; cte_wp_at ((=) (ArchObjectCap cap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base) \<and> (xd = Some (x, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x xa xb xc xd) slot) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. xd = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize xc \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize xc < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr xa + msg ! 0) pd a) s))) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> authorised_for_globals_page_inv (PageGetAddr xa) s)))) \<and> (\<forall>x. cap = PageTableCap x None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xb pd_bits \<and> (\<exists>ref. (ref \<rhd> xb) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xb + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xb + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x (Some (xa, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xb + (msg ! 0 >> 20 << 2))) s))))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x xa s \<and> ?P1382 x xa s \<and> ?P1384 x xa s \<and> ?P1386 x xa s \<and> ?P1388 x xa s \<and> ?P1390 x xa s \<and> ?P1392 x xa s \<and> (\<forall>xb xc. ?P1396 x xa xb xc s)) proof (prove)
goal (1 subgoal):
 1. \<And>s. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap cap\<rbrakk> \<Longrightarrow> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base) \<and> (xd = Some (x, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) xc \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x xa xb xc xd) slot) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. xd = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize xc \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize xc < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr xa + msg ! 0) pd a) s))) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> authorised_for_globals_page_inv (PageGetAddr xa) s)))) \<and> (\<forall>x. cap = PageTableCap x None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>xa. fst (excaps ! 0) = ArchObjectCap xa \<longrightarrow> (\<forall>xb xc. xa = PageDirectoryCap xb xc \<longrightarrow> (\<forall>xa. xc = Some xa \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xb pd_bits \<and> (\<exists>ref. (ref \<rhd> xb) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xb + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xb, xa) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xb + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x (Some (xa, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xb + (msg ! 0 >> 20 << 2))) s))))) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x xa s \<and> ?P1382 x xa s \<and> ?P1384 x xa s \<and> ?P1386 x xa s \<and> ?P1388 x xa s \<and> ?P1390 x xa s \<and> ?P1392 x xa s \<and> (\<forall>xb xc. ?P1396 x xa xb xc s)) proof (prove)
goal (3 subgoals):
 1. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageCap x31 x32 x33 x34 x35); cap = PageCap x31 x32 x33 x34 x35\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s)))
 2. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 3. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (3 subgoals):
 1. \<And>s x31 x32 x33 x34 x35. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base\<rbrakk> \<Longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageMap \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageUnmap \<longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageUnmap \<longrightarrow> (isPageFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (invocation_type label)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))) \<and> (\<not> isPageFlushLabel (invocation_type label) \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageGetAddress \<longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s)))
 2. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 3. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (9 subgoals):
 1. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; arch = ARMPageMap\<rbrakk> \<Longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (x35 = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize x34 - 1 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base) \<and> (x35 = Some (x, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) x34 \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base))))
 2. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 8. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 9. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (9 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size option arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; arch = ARMPageMap\<rbrakk> \<Longrightarrow> 2 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> (option = None \<longrightarrow> \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base) \<and> (option = Some (x, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base))))
 2. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 8. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 9. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (11 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> typ_at (AArch APageDirectory) xa s
 2. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 3. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 9. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 10. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
A total of 11 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> valid_objs s
 2. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size; s \<turnstile> ArchObjectCap (PageDirectoryCap xa (Some xc))\<rbrakk> \<Longrightarrow> typ_at (AArch APageDirectory) xa s
 3. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 4. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 9. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 10. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size; s \<turnstile> ArchObjectCap (PageDirectoryCap xa (Some xc))\<rbrakk> \<Longrightarrow> typ_at (AArch APageDirectory) xa s
 2. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 3. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 9. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 10. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 2. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 9. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 10. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (10 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; is_aligned (msg ! 0) (pageBitsForSize vmpage_size)\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 2. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 9. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 10. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (11 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s\<rbrakk> \<Longrightarrow> 2 ^ pageBitsForSize vmpage_size - 1 < 2 ^ pageBitsForSize vmpage_size
 2. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; msg ! 0 \<le> msg ! 0 + (2 ^ pageBitsForSize vmpage_size - 1)\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 3. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 9. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 10. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> 2 ^ pageBitsForSize vmpage_size - 1 < 2 ^ pageBitsForSize vmpage_size
 2. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; msg ! 0 \<le> msg ! 0 + (2 ^ pageBitsForSize vmpage_size - 1); \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 3. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 9. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 10. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size None; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size None)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<not> kernel_base \<le> msg ! 0 + 2 ^ pageBitsForSize vmpage_size - 1; is_aligned xa pd_bits; (ref \<rhd> xa) s; msg ! 0 \<le> msg ! 0 + (2 ^ pageBitsForSize vmpage_size - 1); \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> msg ! 0 < kernel_base
 2. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 8. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 9. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 10. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (9 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size option aa b ys xa xc. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size option; cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size option)); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; case option of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref vmpage_size \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> option = Some (xc, msg ! 0) \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> vmsz_aligned (msg ! 0) vmpage_size \<longrightarrow> typ_at (AArch APageDirectory) xa s \<and> msg ! 0 < kernel_base
 2. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 8. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 9. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (9 subgoals):
 1. \<And>s x31 word cap_rights vmpage_size aa b ys xa xc ref. \<lbrakk>invs s; cap = PageCap x31 word cap_rights vmpage_size (Some (xc, msg ! 0)); cap_aligned (ArchObjectCap (PageCap x31 word cap_rights vmpage_size (Some (xc, msg ! 0)))); if x31 then typ_at (AArch (ADeviceData vmpage_size)) word s else typ_at (AArch (AUserData vmpage_size)) word s; cap_rights \<in> valid_vm_rights; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; \<And>sz. pageBitsForSize sz < word_bits; is_aligned xa pd_bits; (ref \<rhd> xa) s; vmsz_aligned (msg ! 0) vmpage_size; 0 < xc; xc < 2 ^ local.asid_bits; msg ! 0 < kernel_base\<rbrakk> \<Longrightarrow> typ_at (AArch APageDirectory) xa s
 2. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 7. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 8. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 9. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (8 subgoals):
 1. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnmap; arch = ARMPageUnmap; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageUnmap (PageCap x31 x32 x33 x34 x35) slot) s
 2. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageClean_Data; arch = ARMPageClean_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageClean_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 3. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageInvalidate_Data; arch = ARMPageInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 4. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageCleanInvalidate_Data; arch = ARMPageCleanInvalidate_Data; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageCleanInvalidate_Data)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 5. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageUnify_Instruction; arch = ARMPageUnify_Instruction; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> Suc 0 < length msg \<longrightarrow> (\<forall>a b. x35 = Some (a, b) \<longrightarrow> (\<forall>pd. is_aligned pd pd_bits \<and> (\<exists>ref. (ref \<rhd> pd) s) \<longrightarrow> \<not> msg ! Suc 0 \<le> msg ! 0 \<longrightarrow> \<not> 2 ^ pageBitsForSize x34 \<le> msg ! 0 \<and> \<not> 2 ^ pageBitsForSize x34 < msg ! Suc 0 \<longrightarrow> authorised_for_globals_page_inv (PageFlush (label_to_flush_type (ArchInvocationLabel ARMPageUnify_Instruction)) (msg ! 0 + b) (msg ! Suc 0 + b - 1) (addrFromPPtr x32 + msg ! 0) pd a) s))
 6. \<And>s x31 x32 x33 x34 x35 arch. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; cap = PageCap x31 x32 x33 x34 x35; cap_aligned (ArchObjectCap (PageCap x31 x32 x33 x34 x35)); if x31 then typ_at (AArch (ADeviceData x34)) x32 s else typ_at (AArch (AUserData x34)) x32 s; x33 \<in> valid_vm_rights; case x35 of None \<Rightarrow> True | Some (asid, ref) \<Rightarrow> 0 < asid \<and> asid < 2 ^ local.asid_bits \<and> vmsz_aligned ref x34 \<and> ref < kernel_base; invocation_type label = ArchInvocationLabel ARMPageGetAddress; arch = ARMPageGetAddress; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> authorised_for_globals_page_inv (PageGetAddr x32) s
 7. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 8. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 x42. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageTableCap x41 x42); cap = PageTableCap x41 x42; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> x42 = None \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length msg \<and> (\<exists>a aa b ys. excaps = (a, aa, b) # ys) \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> msg ! 0 \<longrightarrow> is_aligned xa pd_bits \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> (\<forall>pd. (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE xb xaa xba \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, x) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE \<longrightarrow> ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s \<longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (x, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s))))
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 aa b ys xa xc pd ref. \<lbrakk>invs s; s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned xa pd_bits; (ref \<rhd> xa) s; (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits) s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s\<rbrakk> \<Longrightarrow> authorised_for_globals_page_table_inv (PageTableMap (ArchObjectCap (PageTableCap x41 (Some (xc, msg ! 0 && ~~ mask 20)))) slot (PageTablePDE (addrFromPPtr x41) (attribs_from_word (msg ! Suc 0) \<inter> {ParityEnabled}) 0) (xa + (msg ! 0 >> 20 << 2))) s
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 aa b ys xa xc pd ref. \<lbrakk>invs s; s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned xa pd_bits; (ref \<rhd> xa) s; (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s)\<rbrakk> \<Longrightarrow> False
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 aa b ys xa xc pd ref. \<lbrakk>invs s; s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap xa (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned xa pd_bits; (ref \<rhd> xa) s; (case pd (UCAST(32 \<rightarrow> 12) (xa + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xaa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (xa, xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap xa (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s); xa + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = xa\<rbrakk> \<Longrightarrow> False
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 aa b ys xc pd ref. \<lbrakk>s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned (arm_global_pd (arch_state s)) pd_bits; (ref \<rhd> arm_global_pd (arch_state s)) s; (case pd (UCAST(32 \<rightarrow> 12) (arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; \<forall>a b. \<not> cte_wp_at (\<lambda>c. idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}) (a, b) s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s\<rbrakk> \<Longrightarrow> False
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 aa b ys xc pd ref. \<lbrakk>s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned (arm_global_pd (arch_state s)) pd_bits; (ref \<rhd> arm_global_pd (arch_state s)) s; (case pd (UCAST(32 \<rightarrow> 12) (arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<forall>b. \<not> cte_wp_at (\<lambda>c. idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}) (aa, b) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (2 subgoals):
 1. \<And>s x41 aa b ys xc pd ref. \<lbrakk>s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned (arm_global_pd (arch_state s)) pd_bits; (ref \<rhd> arm_global_pd (arch_state s)) s; (case pd (UCAST(32 \<rightarrow> 12) (arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)))) (aa, b) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<not> cte_wp_at (\<lambda>c. idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}) (aa, b) s\<rbrakk> \<Longrightarrow> False
 2. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal (3 subgoals):
 1. \<And>s x41 aa b ys xc pd ref c. \<lbrakk>s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned (arm_global_pd (arch_state s)) pd_bits; (ref \<rhd> arm_global_pd (arch_state s)) s; (case pd (UCAST(32 \<rightarrow> 12) (arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<not> cte_wp_at (\<lambda>c. idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}) (aa, b) s; ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)) = c\<rbrakk> \<Longrightarrow> idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}
 2. \<And>s x41 aa b ys xc pd ref. \<lbrakk>s \<turnstile> ArchObjectCap (PageTableCap x41 None); cap = PageTableCap x41 None; \<And>sz. pageBitsForSize sz < word_bits; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length msg; excaps = (ArchObjectCap (PageDirectoryCap (arm_global_pd (arch_state s)) (Some xc)), aa, b) # ys; \<not> kernel_base \<le> msg ! 0; is_aligned (arm_global_pd (arch_state s)) pd_bits; (ref \<rhd> arm_global_pd (arch_state s)) s; (case pd (UCAST(32 \<rightarrow> 12) (arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) of SuperSectionPDE x xa xb \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && ~~ mask 6 && mask pd_bits >> 2)) | _ \<Rightarrow> pd (UCAST(32 \<rightarrow> 12) (fst (arm_global_pd (arch_state s), xc) + (msg ! 0 >> 20 << 2) && mask pd_bits >> 2))) = InvalidPDE; ako_at (PageDirectory pd) (arm_global_pd (arch_state s)) s; \<forall>x\<in>set ys. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; arm_global_pd (arch_state s) + (msg ! 0 >> 20 << 2) && ~~ mask pd_bits = arm_global_pd (arch_state s); valid_pspace s; valid_mdb s; valid_ioc s; valid_idle s; only_idle s; if_unsafe_then_cap s; valid_reply_caps s; valid_reply_masters s; valid_arch_state s; valid_irq_node s; valid_irq_handlers s; valid_irq_states s; valid_machine_state s; valid_vspace_objs s; valid_arch_caps s; valid_global_objs s; valid_kernel_mappings s; equal_kernel_mappings s; valid_asid_map s; valid_global_vspace_mappings s; pspace_in_kernel_window s; cap_refs_in_kernel_window s; pspace_respects_device_region s; cap_refs_respects_device_region s; cur_tcb s; \<not> cte_wp_at (\<lambda>c. idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}) (aa, b) s; cte_wp_at (\<lambda>c. idle_thread s \<in> cap_range c \<or> arm_global_pd (arch_state s) \<in> cap_range c \<or> (range (interrupt_irq_node s) \<union> set (arm_global_pts (arch_state s))) \<inter> cap_range c \<noteq> {}) (aa, b) s\<rbrakk> \<Longrightarrow> False
 3. \<And>s x51 x52. \<lbrakk>invs s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; s \<turnstile> ArchObjectCap (PageDirectoryCap x51 x52); cap = PageDirectoryCap x51 x52; \<And>sz. pageBitsForSize sz < word_bits\<rbrakk> \<Longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length msg \<longrightarrow> ?P1380 x51 x52 s \<and> ?P1382 x51 x52 s \<and> ?P1384 x51 x52 s \<and> ?P1386 x51 x52 s \<and> ?P1388 x51 x52 s \<and> ?P1390 x51 x52 s \<and> ?P1392 x51 x52 s \<and> (\<forall>x xa. ?P1396 x51 x52 x xa s) proof (prove)
goal:
No subgoals!