theory Arch_C

lemma performPageInvocationMapPTE_ccorres:
  "ccorres (K (K \<bottom>) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_')
       (invs' and cte_at' slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s)
           and valid_pte_slots'2 mapping and (\<lambda>_. asid \<le> mask asid_bits))
       (UNIV \<inter> {s. pte_range_relation (snd (theLeft mapping)) (pte_entries_' s)}
             \<inter> {s. cpte_relation (fst (theLeft mapping)) (pte_' s)}
             \<inter> {s. ccap_relation cap (cap_' s)}
             \<inter> {s. ctSlot_' s = cte_Ptr slot}
             \<inter> {s. asid_' s = asid}
             \<inter> {s. isLeft mapping}) []
       (liftE (performPageInvocation (PageMap asid cap slot mapping)))
       (Call performPageInvocationMapPTE_'proc)" apply (rule ccorres_gen_asm2) apply (rule ccorres_gen_asm) apply (simp only: liftE_liftM ccorres_liftM_simp) apply (cinit lift: pte_entries_' pte_' cap_' ctSlot_' asid_' ) apply (rule_tac P="\<exists>s. valid_pte_slots'2 mapping s" in ccorres_gen_asm) apply (rule ccorres_gen_asm [where P ="snd (theLeft mapping)\<noteq>[]"]) apply (clarsimp simp: isLeft_def bind_assoc simp del: Collect_const) apply (ctac (no_vcg)) apply (ctac (no_vcg) add: pteCheckIfMapped_ccorres) apply csymbr apply (simp add: mapM_discarded whileAnno_def
                       Collect_False
                  del: Collect_const) apply (rule ccorres_Guard_Seq) apply (rule ccorres_basic_srnoop2, simp) apply csymbr apply (rule ccorres_split_nothrow_novcg) apply (rule_tac F="\<lambda>_. valid_pte_slots'2 mapping"
                  in ccorres_mapM_x_while' [where i=0]) apply clarsimp apply (rule ccorres_guard_imp2) apply (rule ccorres_move_array_assertion_pte_16_2
                    | (rule ccorres_flip_Guard, rule ccorres_move_array_assertion_pte_16_2))+ apply (rule storePTE_Basic_ccorres', simp) apply clarsimp apply (clarsimp simp: pte_range_relation_def ptr_range_to_list_def
                                    unat_of_nat) apply (auto simp: valid_pte_slots'2_def upt_conv_Cons[where i=0] of_nat_gt_0)[1] apply (clarsimp simp: pte_range_relation_def ptr_range_to_list_def) apply vcg apply simp apply (simp add: valid_pte_slots'2_def) apply (rule hoare_pre, wp hoare_vcg_ex_lift, simp) apply clarsimp apply (clarsimp simp: pte_range_relation_def ptr_range_to_list_def) apply (rule order_less_le_trans) apply (rule unat_lt2p) apply (simp add: word_bits_def) apply ceqv apply (rule_tac P="valid_pte_slots'2 mapping"
            in ccorres_cross_over_guard) apply csymbr apply (rule ccorres_move_c_guard_pte
                    ccorres_move_array_assertion_pte_16_2
                    ccorres_Guard_Seq
                    ccorres_rhs_assoc)+ apply (ctac add: cleanCacheRange_PoU_ccorres) apply (rule ccorres_move_c_guard_pte
                      ccorres_move_array_assertion_pte_16_2
                      ccorres_rhs_assoc)+ apply (simp add: when_def del: Collect_const) apply (rule ccorres_Cond_rhs_Seq) apply (simp add: to_bool_def) apply (ctac (no_vcg) add: invalidateTLBByASID_ccorres) apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp:return_def) apply (rule wp_post_taut) apply simp apply (rule_tac P=\<top> and P'=UNIV in ccorres_from_vcg_throws) apply (rule allI, rule conseqPre, vcg) apply (clarsimp simp:return_def) apply (wp hoare_vcg_const_imp_lift) [1] apply clarsimp apply (vcg exspec=cleanCacheRange_PoU_modifies) apply (clarsimp simp: to_bool_def) apply (rule hoare_strengthen_post) apply (rule_tac Q'="\<lambda>rv s. valid_pde_mappings' s
                \<and> valid_pte_slots'2 mapping s
                \<and> unat (last (snd (theLeft mapping)) + 3
                    - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s" in hoare_vcg_conj_lift) apply (rule mapM_x_accumulate_checks) apply (simp add: storePTE_def) apply (rule obj_at_setObject3) apply simp apply (simp add: objBits_simps archObjSize_def pteBits_def) apply (simp add: typ_at_to_obj_at_arches[symmetric]) apply ((wp mapM_x_wp_inv hoare_vcg_ex_lift | simp add: valid_pte_slots'2_def)+)[2] apply clarsimp apply (simp add: typ_at_to_obj_at_arches) apply (frule bspec, erule hd_in_set) apply (drule bspec, erule last_in_set) apply (simp add: hd_conv_nth last_conv_nth) apply (rule conj_assoc[where Q="a \<le> b" for a b, THEN iffD1])+ apply (rule conjI) 
 (* the inequality first *)
         apply (clarsimp simp:valid_pte_slots'2_def pteBits_def
          objBits_simps archObjSize_def hd_conv_nth) apply (clarsimp simp:pte_range_relation_def ptr_range_to_list_def ptr_add_def) apply (frule is_aligned_addrFromPPtr_n,simp) apply (cut_tac n = "sz + 2" in  power_not_zero[where 'a="32"]) apply simp apply (subst is_aligned_no_wrap', assumption, fastforce) apply (subst add_diff_eq [symmetric], subst is_aligned_no_wrap', assumption, fastforce) apply (simp add:addrFromPPtr_mask_5) apply (clarsimp simp:pte_range_relation_def ptr_add_def ptr_range_to_list_def
                            addrFromPPtr_mask_5) apply (auto simp: valid_pte_slots'2_def upt_conv_Cons[where i=0])[1] apply (clarsimp simp: guard_is_UNIV_def hd_conv_nth last_conv_nth ucast_minus) apply (clarsimp simp: pte_range_relation_def ptr_range_to_list_def objBits_simps archObjSize_def) apply (simp add: CTypesDefs.ptr_add_def ucast_nat_def word_0_sle_from_less) apply (clarsimp simp: valid_pte_slots'2_def del: disjCI) apply (erule disjE, simp_all add: unat_arith_simps pteBits_def)[1] apply (clarsimp simp: upt_conv_Cons[where i=0]) apply (wp valid_pte_slots_lift2)+ apply (clarsimp simp: pte_range_relation_def hd_map_simp
                         ptr_range_to_list_def valid_pte_slots'2_def
                         word_le_nat_alt power_increasing[where a="2 :: nat" and N=4, simplified]) apply (clarsimp simp: pte_range_relation_def ptr_range_to_list_def unat_1_0
                        valid_pte_slots'2_def isLeft_def last_map hd_map
                        ptr_add_def) apply (auto elim!: order_trans[rotated] simp: unat_word_ariths unat_arith_simps)[1] done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping and (\<lambda>_. asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>pte_range_relation (snd (theLeft mapping)) \<acute>pte_entries\<rbrace> \<inter> \<lbrace>cpte_relation (fst (theLeft mapping)) \<acute>pte\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace> \<inter> \<lbrace>isLeft mapping\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageMap asid cap slot mapping))) (Call performPageInvocationMapPTE_'proc) proof (prove)
goal (1 subgoal):
 1. isLeft mapping \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping and (\<lambda>_. asid \<le> mask local.asid_bits)) (UNIV \<inter> \<lbrace>pte_range_relation (snd (theLeft mapping)) \<acute>pte_entries\<rbrace> \<inter> \<lbrace>cpte_relation (fst (theLeft mapping)) \<acute>pte\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageMap asid cap slot mapping))) (Call performPageInvocationMapPTE_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) (UNIV \<inter> \<lbrace>pte_range_relation (snd (theLeft mapping)) \<acute>pte_entries\<rbrace> \<inter> \<lbrace>cpte_relation (fst (theLeft mapping)) \<acute>pte\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (liftE (performPageInvocation (ARM_H.PageMap asid cap slot mapping))) (Call performPageInvocationMapPTE_'proc) proof (prove)
goal (1 subgoal):
 1. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) (UNIV \<inter> \<lbrace>pte_range_relation (snd (theLeft mapping)) \<acute>pte_entries\<rbrace> \<inter> \<lbrace>cpte_relation (fst (theLeft mapping)) \<acute>pte\<rbrace> \<inter> \<lbrace>ccap_relation cap \<acute>cap\<rbrace> \<inter> \<lbrace>\<acute>ctSlot = cte_Ptr slot\<rbrace> \<inter> \<lbrace>\<acute>asid = asid\<rbrace>) [] (performPageInvocation (ARM_H.PageMap asid cap slot mapping)) (Call performPageInvocationMapPTE_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>asida ctSlot capa pte pte_entries. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2252 asida ctSlot capa pte pte_entries) (?Q'2252 asida ctSlot capa pte pte_entries) [SKIP] (do y <- updateCap slot cap;
y <- case mapping of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(ctSlot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pteCheckIfMapped_'proc(pte_range_C.base_C pte_entries);;
(\<acute>j :== pte_range_C.length_C pte_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asida)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2252 asida ctSlot capa pte pte_entries s \<and> s' \<in> ?Q'2252 asida ctSlot capa pte pte_entries proof (prove)
goal (2 subgoals):
 1. \<And>asida ctSlot capa pte pte_entries. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; \<exists>s. valid_pte_slots'2 mapping s\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2258 asida ctSlot capa pte pte_entries) (?Q'2252 asida ctSlot capa pte pte_entries) [SKIP] (do y <- updateCap slot cap;
y <- case mapping of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(ctSlot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pteCheckIfMapped_'proc(pte_range_C.base_C pte_entries);;
(\<acute>j :== pte_range_C.length_C pte_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asida)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2258 asida ctSlot capa pte pte_entries and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> ?Q'2252 asida ctSlot capa pte pte_entries proof (prove)
goal (2 subgoals):
 1. \<And>asida ctSlot capa pte pte_entries. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; \<exists>s. valid_pte_slots'2 mapping s; snd (theLeft mapping) \<noteq> []\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2259 asida ctSlot capa pte pte_entries) (?Q'2252 asida ctSlot capa pte pte_entries) [SKIP] (do y <- updateCap slot cap;
y <- case mapping of Inl (pte, slots) \<Rightarrow> do tlbFlush <- pteCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePTE pte) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pteBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od | Inr (pde, slots) \<Rightarrow> do tlbFlush <- pdeCheckIfMapped (HaskellLib_H.head slots);
mapM (swp storePDE pde) slots;
doMachineOp $ cleanCacheRange_PoU (VPtr $ fromPPtr $ HaskellLib_H.head slots) (VPtr $ fromPPtr (last slots) + (HaskellLib_H.bit pdeBits - 1)) (addrFromPPtr (HaskellLib_H.head slots));
when tlbFlush $ invalidateTLBByASID asid
od;
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c ctSlot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(ctSlot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pteCheckIfMapped_'proc(pte_range_C.base_C pte_entries);;
(\<acute>j :== pte_range_C.length_C pte_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - SCAST(32 signed \<rightarrow> 32) 1)) + ((1 << unat 2) - SCAST(32 signed \<rightarrow> 32) 1),\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asida)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2259 asida ctSlot capa pte pte_entries and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> ?Q'2252 asida ctSlot capa pte pte_entries proof (prove)
goal (2 subgoals):
 1. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?G2259 asid (cte_Ptr slot) capa pte pte_entries) (?Q'2252 asid (cte_Ptr slot) capa pte pte_entries) [SKIP] (do y <- updateCap slot cap;
x <- pteCheckIfMapped (hd b);
xa <- mapM (swp storePTE a) b;
xa <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when x (invalidateTLBByASID asid);
return []
od) (Guard C_Guard {s. s \<Turnstile>\<^sub>c cte_Ptr slot} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (cap_Ptr &(cte_Ptr slot\<rightarrow>[''cap_C''])) capa)));;
(\<acute>tlbflush_required :== CALL pteCheckIfMapped_'proc(pte_range_C.base_C pte_entries);;
(\<acute>j :== pte_range_C.length_C pte_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))))
 2. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?G2259 asida ctSlot capa pte pte_entries and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> ?Q'2252 asida ctSlot capa pte pte_entries proof (prove)
goal (4 subgoals):
 1. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2285 capa pte pte_entries a s b rv) (?Q'2285 capa pte pte_entries a s b rv xfdc) [SKIP] (do x <- pteCheckIfMapped (hd b);
xa <- mapM (swp storePTE a) b;
xa <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when x (invalidateTLBByASID asid);
return []
od) (\<acute>tlbflush_required :== CALL pteCheckIfMapped_'proc(pte_range_C.base_C pte_entries);;
(\<acute>j :== pte_range_C.length_C pte_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF \<acute>tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))))
 2. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>?Q2285 capa pte pte_entries a s b\<rbrace>
 3. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> ?Q'2285 capa pte pte_entries a s b rv (xfdc sa)
 4. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b rv xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc; rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pte pte_entries a s b rv xfdc rva) (?Q'2319 capa pte pte_entries a s b rv xfdc rva tlbflush_required) [SKIP] (do x <- mapM (swp storePTE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when rva (invalidateTLBByASID asid);
return []
od) (\<acute>j :== pte_range_C.length_C pte_entries;;
(Guard GhostStateError \<lbrace>\<acute>j \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>?Q2319 capa pte pte_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> ?Q'2319 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b rv xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc; rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pte pte_entries a s b rv xfdc rva) (?G'2598 capa pte pte_entries a s b rv xfdc rva tlbflush_required) [SKIP] (do x <- mapM (swp storePTE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when rva (invalidateTLBByASID asid);
return []
od) (Guard GhostStateError \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(WHILE \<acute>i < pte_range_C.length_C pte_entries DO
  Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1
OD;;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>?Q2319 capa pte pte_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) sb \<in> ?G'2598 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2598 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePTE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (Guard GhostStateError \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < pte_range_C.length_C pte_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>?Q2319 capa pte pte_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) sb \<in> ?G'2598 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)) (?C'2847 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePTE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>globals :== ghost'state_'_update id;;
(\<acute>i :== 0;;
(While \<lbrace>\<acute>i < pte_range_C.length_C pte_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>?Q2319 capa pte pte_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) sb \<in> ?C'2847 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t) \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2854 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePTE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>i :== 0;;
(While \<lbrace>\<acute>i < pte_range_C.length_C pte_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>?Q2319 capa pte pte_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) sb \<in> {sb. globals_update (ghost'state_'_update id) sb \<in> ?G'2854 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2319 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2866 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [SKIP] (do _ <- mapM_x (swp storePTE a) b;
x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (While \<lbrace>\<acute>i < pte_range_C.length_C pte_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1);;
(\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>?Q2319 capa pte pte_entries a s b rv xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) sb \<in> {sb. globals_update (ghost'state_'_update id) sb \<in> {sb. i_'_update (\<lambda>_. 0) sb \<in> ?G'2866 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ccorres (?r'2969 capa pte pte_entries a s b xfdc rva tlbflush_required) (?xf'2969 capa pte pte_entries a s b xfdc rva tlbflush_required) (?P2975 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)) (?G'2866 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required) tlbflush_required) [] (mapM_x (swp storePTE a) b) (While \<lbrace>\<acute>i < pte_range_C.length_C pte_entries\<rbrace> (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte)))));;
\<acute>i :== \<acute>i + 1))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'2969 capa pte pte_entries a s b xfdc rva tlbflush_required) rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; ?r'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'2969 capa pte pte_entries a s b xfdc rva tlbflush_required) (?xf'2969 capa pte pte_entries a s b xfdc rva tlbflush_required) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. ?P2975 capa pte pte_entries a s b rv xfdc c and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rva. rva = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {sb. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) sb \<in> {sb. globals_update (ghost'state_'_update id) sb \<in> {sb. i_'_update (\<lambda>_. 0) sb \<in> ?G'2866 capa pte pte_entries a s b rv (xfdc sa) rva (ret__unsigned_long_' t)}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (13 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>n<length b. ccorres dc xfdc (valid_pte_slots'2 mapping) \<lbrace>\<acute>i = word_of_nat 0 + word_of_nat n\<rbrace> [] (swp storePTE a (b ! n)) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pte pte_entries a s b n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (valid_pte_slots'2 (Inl (a, b))) \<lbrace>\<acute>i = word_of_nat n\<rbrace> [] (storePTE (b ! n) a) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa pte pte_entries a s b n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2988 capa pte pte_entries a s b n) (?Q'2988 capa pte pte_entries a s b n) [] (storePTE (b ! n) a) (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))))
 2. \<And>capa pte pte_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pte_slots'2 (Inl (a, b)) sa; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ?Q2988 capa pte pte_entries a s b n sa \<and> s' \<in> ?Q'2988 capa pte pte_entries a s b n
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 10. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>capa pte pte_entries a s b n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?A2995 capa pte pte_entries a s b n) (?C'2995 capa pte pte_entries a s b n) [] (storePTE (b ! n) a) (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))
 2. \<And>capa pte pte_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pte_slots'2 (Inl (a, b)) sa; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> (?A2995 capa pte pte_entries a s b n and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)) sa \<and> s' \<in> ?C'2995 capa pte pte_entries a s b n \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat \<acute>i \<noteq> 0)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 10. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pte pte_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pte_slots'2 (Inl (a, b)) sa; s' \<in> \<lbrace>\<acute>i = word_of_nat n\<rbrace>\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)) sa \<and> s' \<in> \<lbrace>ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) = b ! n\<rbrace> \<inter> \<lbrace>Suc (unat \<acute>i) \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> Suc (unat \<acute>i) \<noteq> 0)\<rbrace> \<inter> \<lbrace>unat \<acute>i \<le> 16 \<and> (\<acute>i \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat \<acute>i \<noteq> 0)\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pte pte_entries a s b n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); n < length b; (sa, s') \<in> rf_sr; valid_pte_slots'2 (Inl (a, b)) sa; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> ptr_val (pte_range_C.base_C pte_entries +\<^sub>p int n) = b ! n \<and> unat (word_of_nat n) \<le> 15 \<and> (word_of_nat n \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6) \<and> unat (word_of_nat n) \<le> 16 \<and> (word_of_nat n \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (word_of_nat n))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>capa pte pte_entries a s n sa s'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)]); n < unat (pte_range_C.length_C pte_entries); (sa, s') \<in> rf_sr; valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) sa; i_' s' = word_of_nat n\<rbrakk> \<Longrightarrow> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> n mod 4294967296 \<le> 15 \<and> (word_of_nat n \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6) \<and> n mod 4294967296 \<le> 16 \<and> (word_of_nat n \<noteq> 0 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < n mod 4294967296)
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 9. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 10. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> (n < pte_range_C.length_C pte_entries) = (n < word_of_nat 0 + word_of_nat (length b))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 8. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 9. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 10. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat \<acute>i) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (i_' s))} (Guard MemorySafety \<lbrace>\<acute>i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat \<acute>i)) (hrs_htd \<acute>t_hrs)\<rbrace> (\<acute>globals :== t_hrs_'_update (hrs_mem_update (heap_update (pte_range_C.base_C pte_entries +\<^sub>p uint \<acute>i) pte))))) \<lbrace>\<acute>i = \<^bsup>s\<^esup>i\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 8. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 10. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa pte pte_entries a s b t_hrs i. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s\<rbrakk> \<Longrightarrow> i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat i) (hrs_htd t_hrs) \<longrightarrow> hrs_htd t_hrs \<Turnstile>\<^sub>t (pte_range_C.base_C pte_entries +\<^sub>p uint i) \<longrightarrow> i = 0 \<or> array_assertion (pte_range_C.base_C pte_entries) (Suc (unat i)) (hrs_htd t_hrs) \<longrightarrow> i = i
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 8. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 10. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>valid_pte_slots'2 mapping\<rbrace> swp storePTE a (b ! n) \<lbrace>\<lambda>_. valid_pte_slots'2 mapping\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s b rva tlbflush_required n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; \<exists>sz\<le>4. length b = 2 ^ sz \<and> is_aligned (hd b) (Suc (Suc sz)) \<and> page_table_at' (hd b && ~~ mask ptBits) s \<and> (sz = 0 \<or> sz = 4); mapping = Inl (a, b); rva = to_bool tlbflush_required; Suc n < length b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. \<exists>sz\<le>4. length b = 2 ^ sz \<and> is_aligned (hd b) (Suc (Suc sz)) \<and> page_table_at' (hd b && ~~ mask ptBits) s \<and> (sz = 0 \<or> sz = 4)\<rbrace> storePTE (b ! n) a \<lbrace>\<lambda>_ s. \<exists>sz\<le>4. length b = 2 ^ sz \<and> is_aligned (hd b) (Suc (Suc sz)) \<and> page_table_at' (hd b && ~~ mask ptBits) s \<and> (sz = 0 \<or> sz = 4)\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> 0 + length b < 2 ^ word_bits
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> length b < 2 ^ word_bits
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])\<rbrakk> \<Longrightarrow> unat (pte_range_C.length_C pte_entries) < 2 ^ word_bits
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])\<rbrakk> \<Longrightarrow> unat (pte_range_C.length_C pte_entries) < ?y3129 capa pte pte_entries a s
 2. \<And>capa pte pte_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])\<rbrakk> \<Longrightarrow> ?y3129 capa pte pte_entries a s \<le> 2 ^ word_bits
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])\<rbrakk> \<Longrightarrow> 2 ^ LENGTH(32) \<le> 2 ^ word_bits
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required rv' t t'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> ceqv \<Gamma> i_' rv' t t' (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (?d'2969 capa pte pte_entries a s b xfdc rva tlbflush_required rv')
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 5. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 7. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>?Q2969 capa pte pte_entries a s b xfdc rva tlbflush_required\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (?Q'2969 capa pte pte_entries a s b xfdc rva tlbflush_required)
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b)\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3286 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?Q3285 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv') [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (\<acute>ret__unsigned_long :== CALL addrFromPPtr_'proc(PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries));;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,\<acute>ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ?P'3286 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> ?Q3285 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv'})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?P'3286 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?G'3290 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long) [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (Guard C_Guard {s. s \<Turnstile>\<^sub>c (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))} (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long);;
Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP)));;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ?P'3286 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?G'3290 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3439 capa pte pte_entries a s b xfdc rva tlbflush_required uu_) (?C'3438 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long) [SKIP] (do x <- doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b)));
y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long);;
(Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and (?A3439 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> ?C'3438 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv) (?Q'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc) [SKIP] (do y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (Guard MemorySafety \<lbrace>pte_range_C.length_C pte_entries = 1 \<or> array_assertion (pte_range_C.base_C pte_entries) (unat (pte_range_C.length_C pte_entries - 1)) (hrs_htd \<acute>t_hrs)\<rbrace> SKIP;;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>?Q3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> ?Q'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa)}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3492 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv) (?C'3491 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv xfdc) [SKIP] (do y <- when (to_bool tlbflush_required) (invalidateTLBByASID asid);
return []
od) (SKIP;;
(IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE)))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. ?A3492 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> ?C'3491 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa) \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?A3492 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?C'3491 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (IF tlbflush_required \<noteq> 0 THEN
  CALL invalidateTLBByASID_'proc(asid)
FI;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. ?A3492 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> ?C'3491 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa) \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3513 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?S3516 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (CALL invalidateTLBByASID_'proc(asid);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> ?Q3513 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?S3516 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa)) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3513 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?S3516 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- invalidateTLBByASID asid;
return []
od) (CALL invalidateTLBByASID_'proc(asid);;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> ?Q3513 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?S3516 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa)) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (11 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0; dc rv xfdc\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?Q3527 capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv) (?Q'3541 capa pte pte_entries a s b xfdca tlbflush_required xfdcb rv xfdc) [SKIP] (return []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3535 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>?Q3527 capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3535 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rvb. dc rvb (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> ?Q'3540 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa) t rvb}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 8. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 10. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals...
flex-flex pairs:
\<lambda>capa pte pte_entries a s b xfdca tlbflush_required xfdcb t rv. ?Q'3541 capa pte pte_entries a s b xfdca tlbflush_required xfdcb rv (xfdc t) \<equiv>\<^sup>? \<lambda>capa pte pte_entries a s b xfdca tlbflush_required. ?Q'3540 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () proof (prove)
goal (11 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0; dc rv xfdc\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3535 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3535 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 8. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 10. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdcb rv xfdc \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0; dc rv xfdc\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3535 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>\<lambda>a b. True\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3535 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 7. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 8. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 9. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 10. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> \<lbrace>?R3535 capa pte pte_entries a s b xfdca True tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()\<rbrace> invalidateTLBByASID asid \<lbrace>\<lambda>a b. True\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and ?R3535 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); \<not> tlbflush_required \<noteq> 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (do y <- if to_bool tlbflush_required then invalidateTLBByASID asid else return ();
return []
od) (SKIP;;
return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. rva)) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); \<not> rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required = 0\<rbrakk> \<Longrightarrow> ccorres (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) (liftxf errstate id (K ()) ret__unsigned_long_') (?R3512 capa pte pte_entries a s b xfdca False 0 () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) ()) (?T3514 capa pte pte_entries a s b xfdca False 0 () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) () xfdc) [SKIP] (return []) (return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE))
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>c. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. rva)) c) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> ?R3512 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long rv c)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {sa. \<forall>rv. dc rv (xfdc sa) \<longrightarrow> sa \<in> {sb. (tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> sb \<in> ?T3514 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long rv (xfdc sa))} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); \<not> rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required = 0\<rbrakk> \<Longrightarrow> \<forall>\<sigma>. \<Gamma>\<turnstile> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} return_C ret__unsigned_long_'_update (\<lambda>s. SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE) {},{s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc \<circ> Inr) rv (liftxf errstate id (K ()) ret__unsigned_long_' s)}
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>a. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. rva)) a) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required rv' ret__unsigned_long xfdc \<sigma>. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); \<not> rva; rv' = word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)); tlbflush_required = 0\<rbrakk> \<Longrightarrow> {s. True \<and> s \<in> UNIV \<and> (\<sigma>, s) \<in> rf_sr} \<subseteq> {s. \<exists>(rv, \<sigma>')\<in>fst (return [] \<sigma>). (\<sigma>', s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>) \<in> rf_sr \<and> (K (K (\<lambda>_. False)) \<currency> dc) (Inr rv) (liftxf errstate id (K ()) ret__unsigned_long_' (s\<lparr>ret__unsigned_long_' := SCAST(32 signed \<rightarrow> 32) EXCEPTION_NONE, global_exn_var_' := Return\<rparr>))}
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>a. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. rva)) a) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<lbrace>?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_\<rbrace> doMachineOp (cleanCacheRange_PoU (hd b) (last b + (2 ^ pteBits - 1)) (addrFromPPtr (hd b))) \<lbrace>\<lambda>rv. (\<lambda>a. (tlbflush_required \<noteq> 0 \<longrightarrow> (valid_pde_mappings' and (\<lambda>_. asid \<le> mask local.asid_bits) and (\<lambda>a. rva)) a) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True)) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>uu_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and ?R3448 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 5. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 6. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 7. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required; rv' = word_of_nat 0 + word_of_nat (length b); ret__unsigned_long = addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdca rva tlbflush_required uu_ rv' ret__unsigned_long) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,ret__unsigned_long) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. (tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> {s. asid_'_update (\<lambda>_. asid) s \<in> UNIV \<inter> \<lbrace>\<acute>asid = asid\<rbrace>} \<inter> {s'. \<forall>t rv. dc rv (xfdc t) \<longrightarrow> s'\<lparr>globals := globals t\<rparr> \<in> UNIV}) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> s \<in> UNIV)} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> rva) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'3446 capa pte pte_entries a s b xfdc (to_bool tlbflush_required) tlbflush_required () (word_of_nat (length b)) (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)))) CALL cleanCacheRange_PoU_'proc(ptr_val (pte_range_C.base_C pte_entries),ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3,addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> rva) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>uu_ rv'. {s'. \<forall>sa. (sa, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping sa \<longrightarrow> s' \<in> {sa. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) sa))) \<longrightarrow> sa\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> ?R'3446 capa pte pte_entries a s b xfdc rva tlbflush_required uu_ rv' v \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (to_bool tlbflush_required)\<rbrace> mapM_x (swp storePTE a) b \<lbrace>\<lambda>_. valid_pte_slots'2 mapping and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s \<and> asid \<le> mask local.asid_bits \<and> rva) \<and> (\<not> tlbflush_required \<noteq> 0 \<longrightarrow> True) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>_. valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2973 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>?Q3686 capa pte pte_entries a s b xfdc tlbflush_required\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); ?Q3686 capa pte pte_entries a s b xfdc tlbflush_required rv sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and ?R2973 capa pte pte_entries a s b rv xfdc c\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P3693 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>?Q3689 capa pte pte_entries a s b xfdc tlbflush_required\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); ?Q3689 capa pte pte_entries a s b xfdc tlbflush_required rv sa \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 5. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. ?P3693 capa pte pte_entries a s b rv xfdc c d \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 6. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 7. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required x. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> storePTE x a \<lbrace>\<lambda>rv. ?P3694 capa pte pte_entries a s b xfdc tlbflush_required x\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>?P3694 capa pte pte_entries a s b xfdc tlbflush_required y\<rbrace> storePTE x a \<lbrace>\<lambda>rv. ?P3694 capa pte pte_entries a s b xfdc tlbflush_required y\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. ?P3694 capa pte pte_entries a s b xfdc tlbflush_required x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. True \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required x. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>\<lambda>s. True\<rbrace> setObject x a \<lbrace>\<lambda>rv. ?P3694 capa pte pte_entries a s b xfdc tlbflush_required x\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>?P3694 capa pte pte_entries a s b xfdc tlbflush_required y\<rbrace> storePTE x a \<lbrace>\<lambda>rv. ?P3694 capa pte pte_entries a s b xfdc tlbflush_required y\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. ?P3694 capa pte pte_entries a s b xfdc tlbflush_required x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. True \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (10 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required x ko sa xa y n. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> updateObject a ko x y n sa = updateObject_default a ko x y n sa
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required x v. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePTE x a \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 5. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 6. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 7. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. True \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 8. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 9. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 10. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (9 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required x v. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b\<rbrakk> \<Longrightarrow> 1 < 2 ^ objBits v
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePTE x a \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 4. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 5. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 6. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. True \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 7. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 8. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 9. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>obj_at' (\<lambda>a. True) y\<rbrace> storePTE x a \<lbrace>\<lambda>rv. obj_at' (\<lambda>a. True) y\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 5. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. True \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 6. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 7. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pte pte_entries a s b x y. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); x \<in> set b; y \<in> set b\<rbrakk> \<Longrightarrow> \<lbrace>pte_at' y\<rbrace> storePTE x a \<lbrace>\<lambda>rv. pte_at' y\<rbrace>
 2. \<And>capa pte pte_entries a s b xfdc tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?P'3692 capa pte pte_entries a s b () xfdc (tlbflush_required \<noteq> 0)\<rbrace> mapM_x (\<lambda>b. storePTE b a) b \<lbrace>\<lambda>rv s. valid_pde_mappings' s \<and> valid_pte_slots'2 mapping s \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize s\<rbrace>
 3. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 5. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>c. valid_pte_slots'2 mapping and (\<lambda>d. True \<and> ?P'3692 capa pte pte_entries a s b rv xfdc c d)\<rbrace>
 6. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 7. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc tlbflush_required rv sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); (\<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa) \<and> valid_pde_mappings' sa \<and> valid_pte_slots'2 mapping sa \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> (valid_pte_slots'2 (Inl (a, b)) and ((\<lambda>s. unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize s) and (\<lambda>_. hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5) and (\<lambda>s. (tlbflush_required \<noteq> 0 \<longrightarrow> valid_pde_mappings' s) \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) and pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) and page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits))) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); \<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa; valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> pte_at' (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); \<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa; valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); \<forall>x\<in>set b. obj_at' (\<lambda>a. True) x sa; valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (hd b) sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (last b + 3 - hd b) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (hd b) sa; obj_at' (\<lambda>a. True) (last b) sa\<rbrakk> \<Longrightarrow> unat (last b + (2 ^ pteBits - 1) - hd b) \<le> gsMaxObjectSize sa \<and> hd b \<le> last b + (2 ^ pteBits - 1) \<and> addrFromPPtr (hd b) \<le> addrFromPPtr (hd b) + (last b + (2 ^ pteBits - 1) - hd b) \<and> hd b && mask 5 = addrFromPPtr (hd b) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> unat (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pteBits - 1) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0) \<and> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> ((unat (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pteBits - 1)) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0)) \<and> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> (unat (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pteBits - 1)) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0)
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> (unat (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0) \<le> gsMaxObjectSize sa \<and> b ! 0 \<le> b ! (length b - Suc 0) + (2 ^ pteBits - 1)) \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (length b - Suc 0) + (2 ^ pteBits - 1) - b ! 0)
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s b sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; mapping = Inl (a, b); valid_pde_mappings' sa; unat (b ! (2 ^ sz - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (2 ^ sz - Suc 0)) sa; sz \<le> 4; length b = 2 ^ sz; is_aligned (b ! 0) (Suc (Suc sz)); page_table_at' (b ! 0 && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (b ! 0 && ~~ mask ptBits) sa\<rbrakk> \<Longrightarrow> b ! 0 \<le> b ! (2 ^ sz - Suc 0) + 3 \<and> addrFromPPtr (b ! 0) \<le> addrFromPPtr (b ! 0) + (b ! (2 ^ sz - Suc 0) + 3 - b ! 0)
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa\<rbrakk> \<Longrightarrow> ptr_val (pte_range_C.base_C pte_entries) \<le> ptr_val (pte_range_C.base_C pte_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) \<le> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) + (2 ^ sz * 4 - 1)
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa; is_aligned (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (Suc (Suc sz))\<rbrakk> \<Longrightarrow> ptr_val (pte_range_C.base_C pte_entries) \<le> ptr_val (pte_range_C.base_C pte_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) \<le> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) + (2 ^ sz * 4 - 1)
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (8 subgoals):
 1. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa; is_aligned (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (Suc (Suc sz))\<rbrakk> \<Longrightarrow> sz + 2 < LENGTH(32)
 2. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa; is_aligned (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pte_range_C.base_C pte_entries) \<le> ptr_val (pte_range_C.base_C pte_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) \<le> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) + (2 ^ sz * 4 - 1)
 3. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 4. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 5. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 6. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 7. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 8. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa; is_aligned (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pte_range_C.base_C pte_entries) \<le> ptr_val (pte_range_C.base_C pte_entries) + 2 ^ sz * 4 - 1 \<and> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) \<le> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) + (2 ^ sz * 4 - 1)
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa; is_aligned (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> ptr_val (pte_range_C.base_C pte_entries) \<le> ptr_val (pte_range_C.base_C pte_entries) + 2 ^ sz * 4 - 1 \<and> True
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (7 subgoals):
 1. \<And>capa pte pte_entries a s sa sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); valid_pde_mappings' sa; unat (2 ^ sz * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (2 ^ sz * 4 - 4)) sa; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa; is_aligned (addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries))) (Suc (Suc sz)); 2 ^ (sz + 2) \<noteq> 0\<rbrakk> \<Longrightarrow> True \<and> True
 2. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 3. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 4. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 5. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 6. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 7. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s b sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, b)) sa; unat (b ! (length b - Suc 0) + 3 - b ! 0) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (b ! 0) sa; obj_at' (\<lambda>a. True) (b ! (length b - Suc 0)) sa\<rbrakk> \<Longrightarrow> b ! 0 && mask 5 = addrFromPPtr (b ! 0) && mask 5 \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa \<and> obj_at' (\<lambda>_. True) (ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1))) sa \<and> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (6 subgoals):
 1. \<And>capa pte pte_entries a s sa. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<unat (pte_range_C.length_C pte_entries)]); valid_pde_mappings' sa; valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<unat (pte_range_C.length_C pte_entries)])) sa; unat (pte_range_C.length_C pte_entries * 4 - 1) \<le> gsMaxObjectSize sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries)) sa; obj_at' (\<lambda>a. True) (ptr_val (pte_range_C.base_C pte_entries) + (pte_range_C.length_C pte_entries * 4 - 4)) sa\<rbrakk> \<Longrightarrow> page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) sa
 2. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 3. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 4. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 5. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 6. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b xfdc rva tlbflush_required. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); rva = to_bool tlbflush_required\<rbrakk> \<Longrightarrow> guard_is_UNIV (\<lambda>rv rv'. rv' = word_of_nat 0 + word_of_nat (length b)) i_' (\<lambda>_ rv'. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> valid_pte_slots'2 mapping s \<longrightarrow> s' \<in> {s. \<forall>v. v = addrFromPPtr (ptr_val (pptr_' (pptr_'_update (\<lambda>_. PTR_COERCE(pte_C \<rightarrow> unit) (pte_range_C.base_C pte_entries)) s))) \<longrightarrow> s\<lparr>ret__unsigned_long_' := v\<rparr> \<in> {s. pstart_'_update (\<lambda>_. v) (end_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) + 3) (start_'_update (\<lambda>_. ptr_val (pte_range_C.base_C pte_entries)) s)) \<in> \<lbrace>\<acute>start = hd b\<rbrace> \<inter> \<lbrace>\<acute>end = last b + (2 ^ pteBits - 1)\<rbrace> \<inter> \<lbrace>\<acute>pstart = addrFromPPtr (hd b)\<rbrace>} \<inter> {s. \<forall>t. s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), ghost'state_' := ghost'state_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr> \<in> (if unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1)) then UNIV else {})} \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace> \<inter> \<lbrace>True\<rbrace> \<inter> \<lbrace>unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> unat (pte_range_C.length_C pte_entries - 1) \<noteq> 0)\<rbrace>}})
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s b sa sb. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); i_' sa = word_of_nat (length b); (sb, sa) \<in> rf_sr; valid_pte_slots'2 (Inl (a, b)) sb\<rbrakk> \<Longrightarrow> ptr_val (pte_range_C.base_C pte_entries) = b ! 0 \<and> 4 + ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) = b ! (length b - Suc 0) + 2 ^ pteBits \<and> addrFromPPtr (ptr_val (pte_range_C.base_C pte_entries)) = addrFromPPtr (b ! 0) \<and> unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s sa sb. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)]); i_' sa = pte_range_C.length_C pte_entries; (sb, sa) \<in> rf_sr; valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_range_C.base_C pte_entries +\<^sub>p int x)) [0..<unat (pte_range_C.length_C pte_entries)])) sb\<rbrakk> \<Longrightarrow> 4 + ptr_val (pte_range_C.base_C pte_entries +\<^sub>p uint (pte_range_C.length_C pte_entries - 1)) = ptr_val (pte_range_C.base_C pte_entries +\<^sub>p (uint (pte_range_C.length_C pte_entries) - 1)) + 2 ^ pteBits \<and> unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s sa sb. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; 0 < unat (pte_range_C.length_C pte_entries); valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<unat (pte_range_C.length_C pte_entries)])) s; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<unat (pte_range_C.length_C pte_entries)]); i_' sa = pte_range_C.length_C pte_entries; (sb, sa) \<in> rf_sr; valid_pte_slots'2 (Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<unat (pte_range_C.length_C pte_entries)])) sb\<rbrakk> \<Longrightarrow> 0xFFFFFFFC + 2 ^ pteBits = 0 \<and> unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s sa sb sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; 1 \<le> pte_range_C.length_C pte_entries; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); i_' sa = pte_range_C.length_C pte_entries; (sb, sa) \<in> rf_sr; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz])) (Suc (Suc sz)); page_table_at' (hd (map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4; page_table_at' (hd (map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]) && ~~ mask ptBits) sb\<rbrakk> \<Longrightarrow> 0xFFFFFFFC + 2 ^ pteBits = 0 \<and> unat (pte_range_C.length_C pte_entries - 1) \<le> 16 \<and> (pte_range_C.length_C pte_entries \<noteq> 1 \<longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6 \<and> 0 < unat (pte_range_C.length_C pte_entries - 1))
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (5 subgoals):
 1. \<And>capa pte pte_entries a s sa sb sz. \<lbrakk>unat asid \<le> unat (mask local.asid_bits); ccap_relation cap capa; cpte_relation a pte; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<16]); unat (i_' sa) = 16; (sb, sa) \<in> rf_sr; unat (pte_range_C.length_C pte_entries) = 16; is_aligned (hd (map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<16])) 6; page_table_at' (hd (map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<16]) && ~~ mask ptBits) s; page_table_at' (hd (map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<16]) && ~~ mask ptBits) sb; sz = 4\<rbrakk> \<Longrightarrow> is_aligned (ptr_val (pte_range_C.base_C pte_entries)) 6
 2. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 3. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 4. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 5. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (4 subgoals):
 1. \<And>capa pte pte_entries a s b rv xfdc. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R2321 capa pte pte_entries a s b rv\<rbrace> pteCheckIfMapped (hd b) \<lbrace>\<lambda>a. valid_pte_slots'2 mapping and (\<lambda>a. True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a)\<rbrace>
 2. \<And>capa pte pte_entries a s b. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b)\<rbrakk> \<Longrightarrow> \<lbrace>?R2289 asid (cte_Ptr slot) capa pte pte_entries\<rbrace> updateCap slot cap \<lbrace>\<lambda>c. (\<lambda>_. True) and ?R2321 capa pte pte_entries a s b c\<rbrace>
 3. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 4. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and ?R2289 asida ctSlot capa pte pte_entries and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (2 subgoals):
 1. \<And>capa pte pte_entries a s b sa rv. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; pte_range_relation b pte_entries; b \<noteq> []; valid_pte_slots'2 (Inl (a, b)) s; mapping = Inl (a, b); dc rv (xfdc sa)\<rbrakk> \<Longrightarrow> sa \<in> {s. s\<lparr>pte___ptr_to_struct_pte_C_' := pte_range_C.base_C pte_entries\<rparr> \<in> UNIV \<inter> \<lbrace>\<acute>pte___ptr_to_struct_pte_C = pte_Ptr (hd b)\<rbrace>} \<inter> {s'. \<forall>t rv. rv = to_bool (ret__unsigned_long_' t) \<longrightarrow> tlbflush_required_'_update (\<lambda>_. ret__unsigned_long_' t) (s'\<lparr>globals := globals t\<rparr>) \<in> {s. j_'_update (\<lambda>_. pte_range_C.length_C pte_entries) s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. i_'_update (\<lambda>_. 0) s \<in> \<lbrace>\<acute>i = word_of_nat 0\<rbrace>}} \<inter> \<lbrace>pte_range_C.length_C pte_entries \<le> 0x10\<rbrace>}}
 2. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> valid_pte_slots'2 mapping a \<and> True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>asida ctSlot capa pte pte_entries s s'. \<lbrakk>isLeft mapping; asid \<le> mask local.asid_bits; asida = asid; ctSlot = cte_Ptr slot; ccap_relation cap capa; cpte_relation (fst (theLeft mapping)) pte; pte_range_relation (snd (theLeft mapping)) pte_entries; (s, s') \<in> rf_sr; (invs' and cte_wp_at' (\<lambda>_. True) slot and (\<lambda>s. 63 \<le> gsMaxObjectSize s) and valid_pte_slots'2 mapping) s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>a. True) and (\<lambda>a. True \<and> valid_pte_slots'2 mapping a \<and> True \<and> valid_pde_mappings' a \<and> valid_pte_slots'2 mapping a \<and> unat (last (snd (theLeft mapping)) + 3 - hd (snd (theLeft mapping))) \<le> gsMaxObjectSize a) and cte_wp_at' (\<lambda>_. True) (ptr_val ctSlot) and (\<lambda>_. snd (theLeft mapping) \<noteq> []) and (\<lambda>_. \<exists>s. valid_pte_slots'2 mapping s)) s \<and> s' \<in> \<lbrace>ccap_relation cap capa\<rbrace> \<inter> \<lbrace>ctSlot = ctSlot\<rbrace> \<inter> \<lbrace>True\<rbrace> proof (prove)
goal (1 subgoal):
 1. \<And>capa pte pte_entries s s' a sz. \<lbrakk>asid \<le> mask local.asid_bits; ccap_relation cap capa; cpte_relation a pte; (s, s') \<in> rf_sr; mapping = Inl (a, map (ptr_val \<circ> (\<lambda>x. pte_Ptr (ptr_val (pte_range_C.base_C pte_entries) + word_of_nat x * 4))) [0..<2 ^ sz]); invs' s; cte_wp_at' (\<lambda>_. True) slot s; 63 \<le> gsMaxObjectSize s; sz \<le> 4; unat (pte_range_C.length_C pte_entries) = 2 ^ sz; is_aligned (ptr_val (pte_range_C.base_C pte_entries)) (Suc (Suc sz)); page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits) s; sz = 0 \<or> sz = 4\<rbrakk> \<Longrightarrow> valid_pde_mappings' s \<and> unat (pte_range_C.length_C pte_entries * 4 - 1) \<le> gsMaxObjectSize s \<and> Ex (page_table_at' (ptr_val (pte_range_C.base_C pte_entries) && ~~ mask ptBits)) proof (prove)
goal:
No subgoals!