theory Machine_C

lemma invalidateCacheRange_RAM_ccorres:
  "ccorres dc xfdc ((\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s)
                    and (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1)
                      \<and> w1 && mask 5 = w3 && mask 5))
                   (\<lbrace>\<acute>start = w1\<rbrace> \<inter> \<lbrace>\<acute>end = w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3\<rbrace>) []
           (doMachineOp (invalidateCacheRange_RAM w1 w2 w3))
           (Call invalidateCacheRange_RAM_'proc)" apply (rule ccorres_gen_asm) apply (cinit' lift: start_' end_' pstart_') apply (clarsimp simp: word_sle_def whileAnno_def split del: if_split) apply (ccorres_remove_UNIV_guard) apply (simp add: invalidateCacheRange_RAM_def doMachineOp_bind when_def
                    empty_fail_invalidateL2Range empty_fail_invalidateByVA
                    empty_fail_dsb dmo_if empty_fail_cond
              split del: if_split) apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_cond[where R=\<top>]) apply (clarsimp simp: lineStart_def cacheLineBits_def) apply (rule ccorres_call[OF cleanCacheRange_RAM_ccorres, where xf'=xfdc], (clarsimp)+) apply (rule ccorres_return_Skip) apply ceqv apply (rule ccorres_split_nothrow_novcg) apply (rule ccorres_cond[where R=\<top>]) apply (clarsimp simp: lineStart_def cacheLineBits_def) apply csymbr apply (rule ccorres_call[OF cleanCacheRange_RAM_ccorres, where xf'=xfdc], (clarsimp)+) apply (rule ccorres_return_Skip) apply ceqv apply (rule_tac P="\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s"
          in ccorres_cross_over_guard) apply (rule ccorres_Guard_Seq) apply (rule ccorres_basic_srnoop2, simp) apply (ctac add: invalidateL2Range_ccorres) apply (rule ccorres_Guard_Seq) apply (rule ccorres_basic_srnoop2, simp) apply (csymbr) apply (rule ccorres_split_nothrow_novcg) apply (rule cacheRangeOp_ccorres) apply (simp add: empty_fail_invalidateByVA) apply clarsimp apply (cinitlift index_') apply (rule ccorres_guard_imp2) apply csymbr apply (ctac add: invalidateByVA_ccorres) apply (clarsimp simp: lineStart_def cacheLineBits_def shiftr_shiftl1
                          mask_out_sub_mask) apply (drule_tac s="w1 && mask 5" in sym, simp add: cache_range_lineIndex_helper) apply (vcg exspec=invalidateByVA_modifies) apply ceqv apply (ctac add: dsb_ccorres) apply wp apply (simp add: guard_is_UNIV_def) apply wp apply (vcg exspec=plat_invalidateL2Range_modifies) apply wp apply (simp add: guard_is_UNIV_def) apply (auto dest: ghost_assertion_size_logic simp: o_def)[1] apply (wp | clarsimp split: if_split)+ apply (clarsimp simp: lineStart_def cacheLineBits_def guard_is_UNIV_def) apply (clarsimp simp: lineStart_mask) apply (subst mask_eqs(7)[symmetric]) apply (subst mask_eqs(8)[symmetric]) apply (simp add: lineStart_mask mask_eqs) done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. ccorres dc xfdc ((\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5)) (\<lbrace>\<acute>start = w1\<rbrace> \<inter> \<lbrace>\<acute>end = w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3\<rbrace>) [] (doMachineOp (invalidateCacheRange_RAM w1 w2 w3)) (Call invalidateCacheRange_RAM_'proc) proof (prove)
goal (1 subgoal):
 1. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5 \<Longrightarrow> ccorres dc xfdc (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) (\<lbrace>\<acute>start = w1\<rbrace> \<inter> \<lbrace>\<acute>end = w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3\<rbrace>) [] (doMachineOp (invalidateCacheRange_RAM w1 w2 w3)) (Call invalidateCacheRange_RAM_'proc) proof (prove)
goal (2 subgoals):
 1. \<And>pstart end start. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1587 pstart end start) (?Q'1587 pstart end start) [SKIP] (doMachineOp (invalidateCacheRange_RAM w1 w2 w3)) (IF start \<noteq> start >> 5 << 5 THEN
  CALL cleanCacheRange_RAM_'proc(start,start,pstart)
FI;;
(IF end + 1 \<noteq> end + 1 >> 5 << 5 THEN
  \<acute>line :== end >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,pstart + (\<acute>line - start))
FI;;
(Guard GhostStateError \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> end - start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> start \<le> end \<and> pstart \<le> pstart + (end - start)\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(pstart,pstart + (end - start));;
(Guard GhostStateError \<lbrace>(gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> end - start \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state) \<and> start \<le> end \<and> pstart \<le> pstart + (end - start)\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== start >> 5;;
(WHILE \<acute>index < (end >> 5) + 1 DO
  \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,pstart + (\<acute>line - start));;
\<acute>index :== \<acute>index + 1
OD;;
CALL dsb_'proc())))))))
 2. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1587 pstart end start s \<and> s' \<in> ?Q'1587 pstart end start proof (prove)
goal (2 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1587 w3 w2 w1) (?Q'1587 w3 w2 w1) [SKIP] (doMachineOp (invalidateCacheRange_RAM w1 w2 w3)) (Cond (if w1 \<noteq> w1 >> 5 << 5 then UNIV else {}) (CALL cleanCacheRange_RAM_'proc(w1,w1,w3)) SKIP;;
(Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))))
 2. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1587 pstart end start s \<and> s' \<in> ?Q'1587 pstart end start proof (prove)
goal (2 subgoals):
 1. \<And>rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1587 w3 w2 w1) (?G'1601 rv') [SKIP] (doMachineOp (invalidateCacheRange_RAM w1 w2 w3)) (Cond (if w1 \<noteq> w1 >> 5 << 5 then UNIV else {}) (CALL cleanCacheRange_RAM_'proc(w1,w1,w3)) SKIP;;
(Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))))
 2. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1587 pstart end start s \<and> s' \<in> {s. s \<in> ?G'1604 pstart end start}
flex-flex pairs:
?G'1604 w3 w2 w1 \<equiv>\<^sup>? ?G'1601 () proof (prove)
goal (2 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1587 w3 w2 w1) (?G'1601 ()) [SKIP] (do rv <- if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ());
rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (Cond (if w1 \<noteq> w1 >> 5 << 5 then UNIV else {}) (CALL cleanCacheRange_RAM_'proc(w1,w1,w3)) SKIP;;
(Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))))
 2. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q1587 pstart end start s \<and> s' \<in> {s. s \<in> ?G'1604 pstart end start}
flex-flex pairs:
?G'1604 w3 w2 w1 \<equiv>\<^sup>? ?G'1601 () proof (prove)
goal (6 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres ?r'1688 ?xf'1688 (?P1692 w3 w2 w1) (?G'1601 ()) [] (if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ())) (Cond (if w1 \<noteq> w1 >> 5 << 5 then UNIV else {}) (CALL cleanCacheRange_RAM_'proc(w1,w1,w3)) SKIP)
 2. \<And>rv' t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ?xf'1688 rv' t t' (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))) (?d'1688 rv')
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; ?r'1688 rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1688 rv) (?Q'1688 rv rv') [SKIP] (do rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1688 rv')
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>?Q1688\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV ?r'1688 ?xf'1688 ?Q'1688
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> (?P1692 pstart end start and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> ?G'1604 pstart end start}
flex-flex pairs:
?G'1604 w3 w2 w1 \<equiv>\<^sup>? ?G'1601 () proof (prove)
goal (8 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (w1 \<noteq> lineStart w1) = (s' \<in> (if w1 \<noteq> w1 >> 5 << 5 then UNIV else {}))
 2. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres ?r'1688 ?xf'1688 (?Pt1706 w3 w2 w1) (?Rt1700 ()) [] (doMachineOp (cleanCacheRange_RAM w1 w1 w3)) (CALL cleanCacheRange_RAM_'proc(w1,w1,w3))
 3. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres ?r'1688 ?xf'1688 (?Pf1705 w3 w2 w1) (?Rf1699 ()) [] (doMachineOp (return ())) SKIP
 4. \<And>rv' t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ?xf'1688 rv' t t' (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))) (?d'1688 rv')
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; ?r'1688 rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1688 rv) (?Q'1688 rv rv') [SKIP] (do rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1688 rv')
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>?Q1688\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV ?r'1688 ?xf'1688 ?Q'1688
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> ?Pt1706 pstart end start s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> ?Pf1705 pstart end start s) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> ?Rt1704 pstart end start \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> ?Rf1703 pstart end start \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})}
flex-flex pairs:
?Rt1704 w3 w2 w1 \<equiv>\<^sup>? ?Rt1700 ()
?Rf1703 w3 w2 w1 \<equiv>\<^sup>? ?Rf1699 () proof (prove)
goal (7 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres ?r'1688 ?xf'1688 (?Pt1706 w3 w2 w1) (?Rt1700 ()) [] (doMachineOp (cleanCacheRange_RAM w1 w1 w3)) (CALL cleanCacheRange_RAM_'proc(w1,w1,w3))
 2. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres ?r'1688 ?xf'1688 (?Pf1705 w3 w2 w1) (?Rf1699 ()) [] (doMachineOp (return ())) SKIP
 3. \<And>rv' t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ceqv \<Gamma> ?xf'1688 rv' t t' (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))) (?d'1688 rv')
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; ?r'1688 rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1688 rv) (?Q'1688 rv rv') [SKIP] (do rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1688 rv')
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>?Q1688\<rbrace>
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV ?r'1688 ?xf'1688 ?Q'1688
 7. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> ?Pt1706 pstart end start s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> ?Pf1705 pstart end start s) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> ?Rt1704 pstart end start \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> ?Rf1703 pstart end start \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})}
flex-flex pairs:
?Rt1704 w3 w2 w1 \<equiv>\<^sup>? ?Rt1700 ()
?Rf1703 w3 w2 w1 \<equiv>\<^sup>? ?Rf1699 () proof (prove)
goal (6 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1705 w3 w2 w1) (?Rf1699 ()) [] (return ()) SKIP
 2. \<And>rv' t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))) (?d'1688 rv')
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1688 rv) (?Q'1688 rv rv') [SKIP] (do rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1688 rv')
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>?Q1688\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc ?Q'1688
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> ?Pf1705 pstart end start s) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> ?Rf1703 pstart end start \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})}
flex-flex pairs:
?Rf1703 w3 w2 w1 \<equiv>\<^sup>? ?Rf1699 () proof (prove)
goal (5 subgoals):
 1. \<And>rv' t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv' t t' (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))) (?d'1688 rv')
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1688 rv) (?Q'1688 rv rv') [SKIP] (do rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1688 rv')
 3. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>?Q1688\<rbrace>
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc ?Q'1688
 5. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (4 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1688 rv) (?Q'1688 rv rv') [SKIP] (do rv <- if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ());
rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP;;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))))
 2. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>?Q1688\<rbrace>
 3. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc ?Q'1688
 4. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?P1730 rv) (?Q'1688 rv rv') [] (if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ())) (Cond (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1))) SKIP)
 2. \<And>rv rv' rv'a t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1729 rv rv') rv'a t t' (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))) (?d'1729 rv rv' rv'a)
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; ?r'1729 rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1729 rv rv' rv'a)
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1729 rv rv') (?xf'1729 rv rv') (?Q'1729 rv rv')
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. ?P1730 rv and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc ?Q'1688
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (10 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<forall>s s'. (s, s') \<in> rf_sr \<and> True \<longrightarrow> (w2 + 1 \<noteq> lineStart (w2 + 1)) = (s' \<in> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?Pt1739 rv) (?Rt1737 rv rv') [] (doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1)))) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1)))
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?Pf1741 rv) (?Rf1737 rv rv') [] (doMachineOp (return ())) SKIP
 4. \<And>rv rv' rv'a t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1729 rv rv') rv'a t t' (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))) (?d'1729 rv rv' rv'a)
 5. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; ?r'1729 rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1729 rv rv' rv'a)
 6. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 7. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1729 rv rv') (?xf'1729 rv rv') (?Q'1729 rv rv')
 8. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pt1739 rv s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pf1741 rv s) and ?R1731 rv\<rbrace>
 9. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. ?Rt1737 rv rv' \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> ?Rf1737 rv rv' \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 10. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (9 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?Pt1739 rv) (?Rt1737 rv rv') [] (doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1)))) (\<acute>line :== w2 >> 5 << 5;;
CALL cleanCacheRange_RAM_'proc(\<acute>line,\<acute>line,w3 + (\<acute>line - w1)))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?Pf1741 rv) (?Rf1737 rv rv') [] (doMachineOp (return ())) SKIP
 3. \<And>rv rv' rv'a t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1729 rv rv') rv'a t t' (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))) (?d'1729 rv rv' rv'a)
 4. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; ?r'1729 rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1729 rv rv' rv'a)
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 6. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1729 rv rv') (?xf'1729 rv rv') (?Q'1729 rv rv')
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pt1739 rv s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pf1741 rv s) and ?R1731 rv\<rbrace>
 8. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. ?Rt1737 rv rv' \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> ?Rf1737 rv rv' \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 9. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (9 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?Pt1739 rv) (?G'1751 rv rv') [] (doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1)))) (CALL cleanCacheRange_RAM_'proc(w2 >> 5 << 5,w2 >> 5 << 5,w3 + ((w2 >> 5 << 5) - w1)))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ccorres (?r'1729 rv rv') (?xf'1729 rv rv') (?Pf1741 rv) (?Rf1737 rv rv') [] (doMachineOp (return ())) SKIP
 3. \<And>rv rv' rv'a t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1729 rv rv') rv'a t t' (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))) (?d'1729 rv rv' rv'a)
 4. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; ?r'1729 rv rv' rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1729 rv rv' rv'a)
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 6. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1729 rv rv') (?xf'1729 rv rv') (?Q'1729 rv rv')
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pt1739 rv s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pf1741 rv s) and ?R1731 rv\<rbrace>
 8. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> ?G'1751 rv rv'} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> ?Rf1737 rv rv' \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 9. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Pf1741 ()) (?Rf1737 () rv') [] (return ()) SKIP
 2. \<And>rv rv' rv'a t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))) (?d'1729 rv rv' rv'a)
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1729 rv rv' rv'a)
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1729 rv rv')
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> ?Pf1741 rv s) and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> ?Rf1737 rv rv' \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' rv'a t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'a t t' (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))) (?d'1729 rv rv' rv'a)
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (?d'1729 rv rv' rv'a)
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1729 rv rv')
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 7. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1729 rv rv' rva) (?Q'1729 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>?Q1729 rv rv'\<rbrace>
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1729 rv rv')
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1812 rv rv' rva) (?Q1810 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ?P'1812 rv rv' rva\<rbrace>
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> ?Q1810 rv rv' rva rv'a})
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1812 rv rv' rva) (?C'1813 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (\<acute>globals :== ghost'state_'_update id;;
(CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ?P'1812 rv rv' rva\<rbrace>
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> ?C'1813 rv rv' rva rv'a \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?P'1812 rv rv' rva) (?G'1815 rv rv' rva rv'a) [SKIP] (do rv <- doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1)));
rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1));;
(Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))))
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ?P'1812 rv rv' rva\<rbrace>
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> ?G'1815 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1820 rv rv' rva rv'a rvb) (?Q'1820 rv rv' rva rv'a rvb xfdca) [SKIP] (do rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (Guard GhostStateError \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace> (\<acute>globals :== ghost'state_'_update id);;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>?Q1820 rv rv' rva rv'a\<rbrace>
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?Q'1820 rv rv' rva rv'a rvb (xfdc s)}
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1820 rv rv' rva rv'a rvb) (?C'1850 rv rv' rva rv'a rvb xfdca) [SKIP] (do rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (\<acute>globals :== ghost'state_'_update id;;
(\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())))
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>?Q1820 rv rv' rva rv'a\<rbrace>
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> ?C'1850 rv rv' rva rv'a rvb (xfdc s) \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1820 rv rv' rva rv'a rvb) (?G'1852 rv rv' rva rv'a rvb xfdca) [SKIP] (do rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (\<acute>index :== w1 >> 5;;
(While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc()))
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>?Q1820 rv rv' rva rv'a\<rbrace>
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. globals_update (ghost'state_'_update id) sa \<in> ?G'1852 rv rv' rva rv'a rvb (xfdc s)} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1820 rv rv' rva rv'a rvb) (?G'1857 rv rv' rva rv'a rvb xfdca) [SKIP] (do rv <- doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3);
doMachineOp dsb
od) (While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1);;
CALL dsb_'proc())
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>?Q1820 rv rv' rva rv'a\<rbrace>
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. globals_update (ghost'state_'_update id) sa \<in> {sa. index_'_update (\<lambda>_. w1 >> 5) sa \<in> ?G'1857 rv rv' rva rv'a rvb (xfdc s)}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> ccorres (?r'1942 rv rv' rva rv'a rvb xfdc) (?xf'1942 rv rv' rva rv'a rvb xfdc) (?P1943 rv rv' rva rv'a rvb) (?G'1857 rv rv' rva rv'a rvb xfdc) [] (doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3)) (While \<lbrace>\<acute>index < (w2 >> 5) + 1\<rbrace> (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1));;
\<acute>index :== \<acute>index + 1))
 2. \<And>rv rv' rva rv'a rvb xfdc rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> ceqv \<Gamma> (?xf'1942 rv rv' rva rv'a rvb xfdc) rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdc rv'b)
 3. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; ?r'1942 rv rv' rva rv'a rvb xfdca rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 5. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> guard_is_UNIV (?r'1942 rv rv' rva rv'a rvb xfdc) (?xf'1942 rv rv' rva rv'a rvb xfdc) (?Q'1942 rv rv' rva rv'a rvb xfdc)
 6. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. ?P1943 rv rv' rva rv'a rvb and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rvb. dc rvb (xfdc s) \<longrightarrow> s \<in> {sa. globals_update (ghost'state_'_update id) sa \<in> {sa. index_'_update (\<lambda>_. w1 >> 5) sa \<in> ?G'1857 rv rv' rva rv'a rvb (xfdc s)}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 8. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 10. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
A total of 12 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdc x y. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> empty_fail (invalidateByVA x y)
 2. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> \<forall>n. ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>index = lineIndex w1 + word_of_nat n\<rbrace> [] (doMachineOp (invalidateByVA (lineStart w1 + word_of_nat n * 0x20) (lineStart w3 + word_of_nat n * 0x20))) (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)))
 3. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 4. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 6. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 7. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 9. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> \<forall>n. ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>index = lineIndex w1 + word_of_nat n\<rbrace> [] (doMachineOp (invalidateByVA (lineStart w1 + word_of_nat n * 0x20) (lineStart w3 + word_of_nat n * 0x20))) (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)))
 2. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 3. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 6. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) \<lbrace>\<acute>index = lineIndex w1 + word_of_nat n\<rbrace> [] (doMachineOp (invalidateByVA (lineStart w1 + word_of_nat n * 0x20) (lineStart w3 + word_of_nat n * 0x20))) (\<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)))
 2. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 3. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 6. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n index. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; index = lineIndex w1 + word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (\<lambda>_. True) UNIV [] (doMachineOp (invalidateByVA (lineStart w1 + word_of_nat n * 0x20) (lineStart w3 + word_of_nat n * 0x20))) (\<acute>line :== index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)))
 2. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 3. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 6. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
A total of 13 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n index. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; index = lineIndex w1 + word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2016 n index) (?Q'2016 n index) [] (doMachineOp (invalidateByVA (lineStart w1 + word_of_nat n * 0x20) (lineStart w3 + word_of_nat n * 0x20))) (\<acute>line :== index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)))
 2. \<And>n index s s'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; index = lineIndex w1 + word_of_nat n; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2016 n index s \<and> s' \<in> ?Q'2016 n index
 3. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 4. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 6. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 7. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 9. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>n index. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; index = lineIndex w1 + word_of_nat n\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q2016 n index) (?G'2021 n index) [] (doMachineOp (invalidateByVA (lineStart w1 + word_of_nat n * 0x20) (lineStart w3 + word_of_nat n * 0x20))) (CALL invalidateByVA_'proc(index << 5,w3 + ((index << 5) - w1)))
 2. \<And>n index s s'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; index = lineIndex w1 + word_of_nat n; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ?Q2016 n index s \<and> s' \<in> {s. line_'_update (\<lambda>_. index << 5) s \<in> ?G'2021 n index}
 3. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 4. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 6. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 7. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 9. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n index s s'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; index = lineIndex w1 + word_of_nat n; (s, s') \<in> rf_sr; True; s' \<in> UNIV\<rbrakk> \<Longrightarrow> True \<and> s' \<in> {s. line_'_update (\<lambda>_. index << 5) s \<in> {s. paddr_'_update (\<lambda>_. w3 + ((index << 5) - w1)) (vaddr_'_update (\<lambda>_. index << 5) s) \<in> \<lbrace>\<acute>vaddr = lineStart w1 + word_of_nat n * 0x20\<rbrace> \<inter> \<lbrace>\<acute>paddr = lineStart w3 + word_of_nat n * 0x20\<rbrace>}}
 2. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 3. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 6. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
A total of 13 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>n s s'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; (s, s') \<in> rf_sr\<rbrakk> \<Longrightarrow> lineIndex w1 + word_of_nat n << 5 = w1 - (w3 && mask 5) + word_of_nat n * 0x20
 2. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 3. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 5. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 6. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 8. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 10. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<forall>s. \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> {s} \<acute>line :== \<acute>index << 5;;
CALL invalidateByVA_'proc(\<acute>line,w3 + (\<acute>line - w1)) \<lbrace>\<acute>index = \<^bsup>s\<^esup>index\<rbrace>
 2. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 3. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 4. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 5. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 6. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 7. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 8. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 9. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 10. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca rv'b t t'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> ceqv \<Gamma> xfdc rv'b t t' (CALL dsb_'proc()) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 2. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (?d'1942 rv rv' rva rv'a rvb xfdca rv'b)
 3. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 4. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 5. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 6. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 7. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 8. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 9. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 10. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca rvc rv'b. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca; dc rvc rv'b\<rbrakk> \<Longrightarrow> ccorres dc xfdc (?Q1942 rv rv' rva rv'a rvb xfdca rvc) (?Q'1942 rv rv' rva rv'a rvb xfdca rvc rv'b) [SKIP] (doMachineOp dsb) (CALL dsb_'proc())
 2. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>?Q1942 rv rv' rva rv'a rvb xfdc\<rbrace>
 3. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (?Q'1942 rv rv' rva rv'a rvb xfdca)
 4. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 5. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 6. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 7. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 8. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 9. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 10. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (9 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdc. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdc\<rbrakk> \<Longrightarrow> \<lbrace>?R1944 rv rv' rva rv'a rvb\<rbrace> doMachineOp (cacheRangeOp invalidateByVA w1 w2 w3) \<lbrace>\<lambda>rvc _. True\<rbrace>
 2. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s \<in> UNIV})
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and ?R1944 rv rv' rva rv'a rvb\<rbrace>
 4. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 6. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 8. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 9. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (8 subgoals):
 1. \<And>rv rv' rva rv'a rvb xfdca. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a; dc rvb xfdca\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rvc rv'b. {s. s \<in> UNIV})
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and (\<lambda>a. True)\<rbrace>
 3. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 5. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 7. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 8. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (7 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<lbrace>?R1822 rv rv' rva\<rbrace> doMachineOp (invalidateL2Range w3 (w3 + (w2 - w1))) \<lbrace>\<lambda>rvb. (\<lambda>_. w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) and (\<lambda>a. True)\<rbrace>
 2. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and ?R1822 rv rv' rva)\<rbrace>
 4. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 6. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 7. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (6 subgoals):
 1. \<And>rv rv' rva rv'a. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'; dc rva rv'a\<rbrakk> \<Longrightarrow> \<Gamma>\<turnstile>\<^bsub>/UNIV\<^esub> (?R'1820 rv rv' rva rv'a) CALL plat_invalidateL2Range_'proc(w3,w3 + (w2 - w1)) {s. \<forall>rv. dc rv (xfdc s) \<longrightarrow> s \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. index_'_update (\<lambda>_. w1 >> 5) s \<in> \<lbrace>\<acute>index = w1 >> 5\<rbrace>}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>}
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and (\<lambda>a. (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True))\<rbrace>
 3. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> ?R'1820 rv rv' rva rv'a} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 5. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 6. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (5 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> \<lbrace>?R1731 rv\<rbrace> if w2 + 1 \<noteq> lineStart (w2 + 1) then doMachineOp (cleanCacheRange_RAM (lineStart w2) (lineStart w2) (w3 + (lineStart w2 - w1))) else doMachineOp (return ()) \<lbrace>\<lambda>rva. (\<lambda>s. unat (w2 - w1) \<le> gsMaxObjectSize s) and ((\<lambda>_. True) and (\<lambda>a. (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True))\<rbrace>
 2. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> w2 - w1 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 3. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and ?R1731 rv\<rbrace>
 4. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 5. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (4 subgoals):
 1. \<And>rv rv'. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; dc rv rv'\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rva rv'a. {s'. \<forall>s. (s, s') \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize s \<longrightarrow> s' \<in> {s. globals_update (ghost'state_'_update id) s \<in> {s. end_'_update (\<lambda>_. w3 + (w2 - w1)) (start_'_update (\<lambda>_. w3) s) \<in> \<lbrace>\<acute>start = w3\<rbrace> \<inter> \<lbrace>\<acute>end = w3 + (w2 - w1)\<rbrace>} \<inter> {s. \<forall>t rv. dc rv (xfdc (s\<lparr>globals := globals s\<lparr>active_irq_' := active_irq_' (globals t), armKSASIDTable_' := armKSASIDTable_' (globals t), armKSHWASIDTable_' := armKSHWASIDTable_' (globals t), armKSNextASID_' := armKSNextASID_' (globals t), avail_reg_' := avail_reg_' (globals t), current_extra_caps_' := current_extra_caps_' (globals t), current_fault_' := current_fault_' (globals t), current_lookup_fault_' := current_lookup_fault_' (globals t), current_syscall_error_' := current_syscall_error_' (globals t), intStateIRQTable_' := intStateIRQTable_' (globals t), isFPUEnabledCached_' := isFPUEnabledCached_' (globals t), ksCurDomain_' := ksCurDomain_' (globals t), ksCurThread_' := ksCurThread_' (globals t), ksDomScheduleIdx_' := ksDomScheduleIdx_' (globals t), ksDomainTime_' := ksDomainTime_' (globals t), ksIdleThread_' := ksIdleThread_' (globals t), ksNumCPUs_' := ksNumCPUs_' (globals t), ksReadyQueues_' := ksReadyQueues_' (globals t), ksReadyQueuesL1Bitmap_' := ksReadyQueuesL1Bitmap_' (globals t), ksReadyQueuesL2Bitmap_' := ksReadyQueuesL2Bitmap_' (globals t), ksSchedulerAction_' := ksSchedulerAction_' (globals t), ksWorkUnitsCompleted_' := ksWorkUnitsCompleted_' (globals t), ndks_boot_' := ndks_boot_' (globals t), phantom_machine_state_' := phantom_machine_state_' (globals t), rootserver_' := rootserver_' (globals t), rootserver_mem_' := rootserver_mem_' (globals t), t_hrs_' := t_hrs_' (globals t), tlbLockCount_' := tlbLockCount_' (globals t)\<rparr>\<rparr>)) \<longrightarrow> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> w2 - w1 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))}} \<inter> \<lbrace>gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc \<acute>ghost'state\<rbrace>})
 2. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and (\<lambda>s. (w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> unat (w2 - w1) \<le> gsMaxObjectSize s \<and> True \<and> (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True) \<and> (\<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> unat (w2 - w1) \<le> gsMaxObjectSize s \<and> True \<and> (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True))\<rbrace>
 3. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 4. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (4 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<forall>s. (\<exists>sa. (sa, s) \<in> rf_sr \<and> unat (w2 - w1) \<le> gsMaxObjectSize sa) \<longrightarrow> (ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s)) = 0 \<or> w2 - w1 \<le> ghost_assertion_data_get cap_get_capSizeBits_'proc (\<lambda>x. snd (snd x)) (ghost'state_' (globals s))) \<and> (gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s)) = 0 \<or> w2 - w1 \<le> gs_get_assn cap_get_capSizeBits_'proc (ghost'state_' (globals s)))
 2. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and (\<lambda>s. (w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> unat (w2 - w1) \<le> gsMaxObjectSize s \<and> True \<and> (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True) \<and> (\<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> unat (w2 - w1) \<le> gsMaxObjectSize s \<and> True \<and> (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True))\<rbrace>
 3. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 4. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (3 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> \<lbrace>?R1691 w3 w2 w1\<rbrace> if w1 \<noteq> lineStart w1 then doMachineOp (cleanCacheRange_RAM w1 w1 w3) else doMachineOp (return ()) \<lbrace>\<lambda>rv. (\<lambda>_. True) and (\<lambda>s. w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> lineStart w2 \<le> lineStart w2 \<and> w3 + (lineStart w2 - w1) \<le> w3 + (lineStart w2 - w1) + (lineStart w2 - lineStart w2) \<and> lineStart w2 && mask 5 = w3 + (lineStart w2 - w1) && mask 5 \<and> unat (lineStart w2 - lineStart w2) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> True) and (\<lambda>s. (w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> unat (w2 - w1) \<le> gsMaxObjectSize s \<and> True \<and> (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True) \<and> (\<not> w2 + 1 \<noteq> lineStart (w2 + 1) \<longrightarrow> unat (w2 - w1) \<le> gsMaxObjectSize s \<and> True \<and> (w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5) \<and> True))\<rbrace>
 2. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> guard_is_UNIV dc xfdc (\<lambda>rv rv'. {s. line_'_update (\<lambda>_. w2 >> 5 << 5) s \<in> {s. pstart_'_update (\<lambda>_. w3 + ((w2 >> 5 << 5) - w1)) (end_'_update (\<lambda>_. w2 >> 5 << 5) (start_'_update (\<lambda>_. w2 >> 5 << 5) s)) \<in> \<lbrace>\<acute>start = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>end = lineStart w2\<rbrace> \<inter> \<lbrace>\<acute>pstart = w3 + (lineStart w2 - w1)\<rbrace>}} \<inter> (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if w2 + 1 \<noteq> w2 + 1 >> 5 << 5 then UNIV else {}))
 3. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and ?R1691 pstart end start) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (2 subgoals):
 1. \<lbrakk>w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5\<rbrakk> \<Longrightarrow> (w2 >> 5 << 5 = lineStart w2 \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rv rv'. UNIV)) \<and> (w2 >> 5 << 5 \<noteq> lineStart w2 \<longrightarrow> (w2 + 1 \<noteq> w2 + 1 >> 5 << 5 \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rv rv'. {})) \<and> (w2 + 1 = w2 + 1 >> 5 << 5 \<longrightarrow> guard_is_UNIV (\<lambda>a b. True) xfdc (\<lambda>rv rv'. UNIV)))
 2. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and (\<lambda>a. True \<and> ((\<lambda>a. end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> lineStart end \<le> lineStart end) and ((\<lambda>a. end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> pstart + (lineStart end - start) \<le> pstart + (lineStart end - start) + (lineStart end - lineStart end)) and ((\<lambda>a. end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> lineStart end && mask 5 = pstart + (lineStart end - start) && mask 5) and (\<lambda>a. (start \<noteq> lineStart start \<longrightarrow> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (lineStart end - lineStart end) \<le> gsMaxObjectSize a) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> True) \<and> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True)) \<and> (\<not> start \<noteq> lineStart start \<longrightarrow> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (lineStart end - lineStart end) \<le> gsMaxObjectSize a) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> True) \<and> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True)))))) a)) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (1 subgoal):
 1. \<And>pstart end start s s'. \<lbrakk>w1 \<le> w2 \<and> w3 \<le> w3 + (w2 - w1) \<and> w1 && mask 5 = w3 && mask 5; pstart = w3; end = w2; start = w1; (s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; s' \<in> UNIV\<rbrakk> \<Longrightarrow> ((\<lambda>_. True) and (\<lambda>s. start \<noteq> lineStart start \<longrightarrow> start \<le> start \<and> pstart \<le> pstart + (start - start) \<and> start && mask 5 = pstart && mask 5 \<and> unat (start - start) \<le> gsMaxObjectSize s) and (\<lambda>s. \<not> start \<noteq> lineStart start \<longrightarrow> True) and (\<lambda>a. True \<and> ((\<lambda>a. end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> lineStart end \<le> lineStart end) and ((\<lambda>a. end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> pstart + (lineStart end - start) \<le> pstart + (lineStart end - start) + (lineStart end - lineStart end)) and ((\<lambda>a. end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> lineStart end && mask 5 = pstart + (lineStart end - start) && mask 5) and (\<lambda>a. (start \<noteq> lineStart start \<longrightarrow> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (lineStart end - lineStart end) \<le> gsMaxObjectSize a) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> True) \<and> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True)) \<and> (\<not> start \<noteq> lineStart start \<longrightarrow> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (lineStart end - lineStart end) \<le> gsMaxObjectSize a) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> True) \<and> (end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True) \<and> (\<not> end + 1 \<noteq> lineStart (end + 1) \<longrightarrow> unat (end - start) \<le> gsMaxObjectSize a \<and> True \<and> (start \<le> end \<and> pstart \<le> pstart + (end - start) \<and> start && mask 5 = pstart && mask 5) \<and> True)))))) a)) s \<and> s' \<in> {s. s \<in> {s. pstart_'_update (\<lambda>_. pstart) (end_'_update (\<lambda>_. start) (start_'_update (\<lambda>_. start) s)) \<in> \<lbrace>\<acute>start = start\<rbrace> \<inter> \<lbrace>\<acute>end = start\<rbrace> \<inter> \<lbrace>\<acute>pstart = pstart\<rbrace>} \<inter> (if start \<noteq> start >> 5 << 5 then UNIV else {}) \<union> UNIV \<inter> - (if start \<noteq> start >> 5 << 5 then UNIV else {})} proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; w2 + 1 \<noteq> lineStart (w2 + 1)\<rbrakk> \<Longrightarrow> w3 + (lineStart w2 - w1) && mask 5 = 0 proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; w2 + 1 \<noteq> lineStart (w2 + 1)\<rbrakk> \<Longrightarrow> (w3 && mask 5) + (lineStart w2 - w1 && mask 5) && mask 5 = 0 proof (prove)
goal (1 subgoal):
 1. \<And>s s'. \<lbrakk>(s, s') \<in> rf_sr; unat (w2 - w1) \<le> gsMaxObjectSize s; w1 \<le> w2; w3 \<le> w3 + (w2 - w1); w1 && mask 5 = w3 && mask 5; w2 + 1 \<noteq> lineStart (w2 + 1)\<rbrakk> \<Longrightarrow> (w3 && mask 5) + ((lineStart w2 && mask 5) - (w1 && mask 5) && mask 5) && mask 5 = 0 proof (prove)
goal:
No subgoals!