theory ArchDecode_IF

lemma arch_decode_invocation_reads_respects_f[Decode_IF_assms]:
  notes reads_respects_f_inv' = reads_respects_f_inv[where st=st]
  notes whenE_wps[wp_split del]
  shows
    "reads_respects_f aag l
       (silc_inv aag st and invs and pas_refined aag and cte_wp_at ((=) (cap.ArchObjectCap cap)) slot
                        and (\<lambda>s. \<forall>(cap, slot) \<in> set excaps. cte_wp_at ((=) cap) slot s)
                        and K (\<forall>(cap, slot) \<in> {(cap.ArchObjectCap cap, slot)} \<union> set excaps.
                                 aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and>
                                 is_subject aag (fst slot) \<and>
                                 (\<forall>v \<in> cap_asid' cap. is_subject_asid aag v)))
        (arch_decode_invocation label args cap_index slot cap excaps)" unfolding arch_decode_invocation_def apply (rule equiv_valid_guard_imp) apply (subst gets_applyE)+ apply (wp check_vp_wpR  reads_respects_f_inv'[OF get_asid_pool_rev]
             reads_respects_f_inv'[OF ensure_empty_rev]
             reads_respects_f_inv'[OF lookup_slot_for_cnode_op_rev]
             reads_respects_f_inv'[OF ensure_no_children_rev]
             reads_respects_f_inv'[OF ensure_safe_mapping_reads_respects]
             reads_respects_f_inv'[OF resolve_vaddr_reads_respects]
             reads_respects_f_inv'[OF create_mapping_entries_rev]
             reads_respects_f_inv'[OF check_vp_alignment_rev]
             reads_respects_f_inv'[OF lookup_error_on_failure_rev]
             find_pd_for_asid_reads_respects gets_apply_ev
             reads_respects_f_inv'[OF get_master_pde_reads_respects]
             is_final_cap_reads_respects find_pd_for_asid_authority2
             select_ext_ev_bind_lift
             select_ext_ev_bind_lift[simplified]
          | wpc
          | simp add: Let_def unlessE_whenE
          | wp (once) whenE_throwError_wp)+ apply (intro impI allI conjI) apply (rule requiv_arm_asid_table_asid_high_bits_of_asid_eq') apply fastforce apply (simp add: reads_equiv_f_def) apply blast apply (fastforce simp: aag_cap_auth_ASIDPoolCap) apply (rule pas_cap_cur_auth_ASIDControlCap[where aag=aag]) apply fastforce apply (simp add: reads_equiv_f_def) apply blast apply clarify apply (subgoal_tac "excaps ! 0 \<in> set excaps", fastforce) apply (rule nth_mem) apply (erule less_trans[rotated], simp) apply (subgoal_tac "excaps ! (Suc 0) \<in> set excaps") apply (rule_tac slot="snd (excaps ! (Suc 0))"
                                        in owns_cnode_owns_obj_ref_of_child_cnodes) apply blast apply (fastforce) apply (fastforce) apply assumption apply (fastforce intro: nth_mem) apply clarify apply (subgoal_tac "excaps ! Suc 0 \<in> set excaps") apply (rule_tac cap="fst (excaps ! Suc 0)" and p="snd (excaps ! Suc 0)"
                                       in caps_of_state_pasObjectAbs_eq) apply (rule cte_wp_at_caps_of_state') apply fastforce apply (erule cap_auth_conferred_cnode_cap) apply fastforce apply assumption apply (fastforce intro: nth_mem) apply (fastforce intro: nth_mem) apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (fastforce intro: aag_cap_auth_PageDirectoryCap_asid) apply fastforce apply (simp add: lookup_pd_slot_def) apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (subst vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                                          simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply (simp add: lookup_pd_slot_def) apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (subst vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                                         simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply fastforce apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply fastforce 
                  (* clagged from Arch_AI *)
                   apply (simp add: linorder_not_le kernel_base_less_observation
                                   vmsz_aligned_def p_assoc_help) apply (subst(asm) mask_lower_twice[symmetric]) prefer 2 apply (subst(asm) is_aligned_add_helper,
                          assumption) apply (rule word_power_less_1) apply (case_tac xc, simp_all)[1] apply simp apply (case_tac xc, simp_all)[1] apply (rule ball_subset[OF _ vspace_cap_rights_to_auth_mask_vm_rights]) apply (fastforce simp: aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def) apply (simp add: lookup_pd_slot_def) apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (subst vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                                   simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply (simp add: lookup_pd_slot_def) apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (subst vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                                  simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply fastforce apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply fastforce apply (fastforce dest: cte_wp_valid_cap simp: valid_cap_simps) apply (rule ball_subset[OF _ vspace_cap_rights_to_auth_mask_vm_rights]) apply (fastforce simp: aag_cap_auth_def cap_auth_conferred_def arch_cap_auth_conferred_def) apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (fastforce intro: aag_cap_auth_PageDirectoryCap_asid) apply fastforce apply (subgoal_tac "excaps ! 0 \<in> set excaps") apply (subst vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                           simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply fastforce apply blast apply blast apply (blast dest: aag_can_read_self) apply (force dest: silc_inv_not_subject) apply (simp add: lookup_pd_slot_def) apply (subst vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                     simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (fastforce dest: aag_cap_auth_PageDirectoryCap) apply (clarsimp simp: lookup_pd_slot_def
                 split: option.splits kernel_object.splits arch_kernel_obj.splits pde.splits) apply (subst (asm) vaddr_segment_nonsense) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                    simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (subst(asm) vaddr_segment_nonsense2) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                    simp: obj_ref_of_def cap_aligned_def cap_bits_def) apply (rule_tac pd=x and s=s in lookup_pt_slot_no_fail_is_subject) apply (erule exI) apply (simp add: invs_def valid_state_def) apply (simp add: invs_def valid_state_def valid_pspace_def) apply assumption apply (erule(1) aag_cap_auth_PageDirectoryCap) apply (fastforce dest: cte_wp_valid_cap cap_aligned_valid
                      simp: obj_ref_of_def cap_aligned_def cap_bits_def pd_bits) apply simp apply assumption apply assumption done

(* Proof state trace *)
proof (prove)
goal (1 subgoal):
 1. reads_respects_f aag l (silc_inv aag st and invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))) (arch_decode_invocation label args cap_index slot cap excaps) proof (prove)
goal (1 subgoal):
 1. reads_respects_f aag l (silc_inv aag st and invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))) (case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of base));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length args \<and> 1 < length excaps then let index = args ! 0; depth = args ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> 0 < length excaps then let vaddr = args ! 0; rights_mask = args ! 1; attr = args ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some a \<Rightarrow> returnOk a;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length args \<and> 0 < length excaps then let vaddr = args ! 0; attr = args ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
frame_info <- liftE $ resolve_vaddr pd start;
case frame_info of None \<Rightarrow> returnOk $ InvokePageDirectory PageDirectoryNothing | Some (frame_size, frame_base) \<Rightarrow> let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE
odE else throwError TruncatedMessage else throwError IllegalOperation) proof (prove)
goal (2 subgoals):
 1. reads_respects_f aag l ?Q (case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap x None) \<Rightarrow> doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
pool_ptr <- returnOk (asid_table (asid_high_bits_of base));
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap x (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length args \<and> 1 < length excaps then let index = args ! 0; depth = args ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> 0 < length excaps then let vaddr = args ! 0; rights_mask = args ! 1; attr = args ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some a \<Rightarrow> returnOk a;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length args \<and> 0 < length excaps then let vaddr = args ! 0; attr = args ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
frame_info <- liftE $ resolve_vaddr pd start;
case frame_info of None \<Rightarrow> returnOk $ InvokePageDirectory PageDirectoryNothing | Some (frame_size, frame_base) \<Rightarrow> let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE
odE else throwError TruncatedMessage else throwError IllegalOperation)
 2. \<And>s. (silc_inv aag st and invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))) s \<Longrightarrow> ?Q s proof (prove)
goal (2 subgoals):
 1. reads_respects_f aag l ?Q (case cap of ASIDPoolCap p base \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDPoolAssign then if 0 < length excaps then let (pd_cap, pd_cap_slot) = excaps ! 0 in case pd_cap of ArchObjectCap (PageDirectoryCap xa None) \<Rightarrow> doE a <- liftE (gets_apply (arm_asid_table \<circ> arch_state) (asid_high_bits_of base));
pool_ptr <- returnOk a;
whenE (pool_ptr = None) $ throwError $ FailedLookup False InvalidRoot;
whenE (p \<noteq> the pool_ptr) $ throwError $ InvalidCapability 0;
pool <- liftE $ get_asid_pool p;
free_set <- returnOk (- dom pool \<inter> {x. UCAST(10 \<rightarrow> 32) x + base \<noteq> 0});
whenE (free_set = {}) $ throwError DeleteFirst;
offset <- liftE $ select_ext (\<lambda>_. free_asid_pool_select pool base) free_set;
returnOk $ InvokeASIDPool $ Assign (UCAST(10 \<rightarrow> 32) offset + base) p pd_cap_slot
odE | ArchObjectCap (PageDirectoryCap xa (Some a)) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1 else throwError TruncatedMessage else throwError IllegalOperation | ASIDControlCap \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMASIDControlMakePool then if 1 < length args \<and> 1 < length excaps then let index = args ! 0; depth = args ! 1; (untyped, parent_slot) = excaps ! 0; root = fst (excaps ! 1) in doE asid_table <- liftE $ gets (arm_asid_table \<circ> arch_state);
free_set <- returnOk (- dom asid_table \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1});
whenE (free_set = {}) $ throwError DeleteFirst;
free <- liftE $ select_ext (\<lambda>_. free_asid_select asid_table) free_set;
base <- returnOk (UCAST(7 \<rightarrow> 32) free << local.asid_low_bits);
(p, n) <- case untyped of UntypedCap True p n f \<Rightarrow> throwError $ InvalidCapability 1 | UntypedCap False p n f \<Rightarrow> returnOk (p, n) | _ \<Rightarrow> throwError $ InvalidCapability 1;
frame <- if n = pageBits then doE ensure_no_children parent_slot;
returnOk p
odE else throwError $ InvalidCapability 1;
dest_slot <- lookup_target_slot root (to_bl index) (unat depth);
ensure_empty dest_slot;
returnOk $ InvokeASIDControl $ MakePool frame dest_slot parent_slot base
odE else throwError TruncatedMessage else throwError IllegalOperation | PageCap dev p R pgsz mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageMap then if 2 < length args \<and> 0 < length excaps then let vaddr = args ! 0; rights_mask = args ! 1; attr = args ! 2; pd_cap = fst (excaps ! 0) in doE (pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
case mapped_address of None \<Rightarrow> doE vtop <- returnOk (vaddr + (1 << pageBitsForSize pgsz) - 1);
whenE (kernel_base \<le> vtop) $ throwError $ InvalidArgument 0
odE | Some (asid', vaddr') \<Rightarrow> doE whenE (asid' \<noteq> asid) (throwError $ InvalidCapability 1);
whenE (vaddr' \<noteq> vaddr) (throwError $ InvalidArgument 0)
odE;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
vm_rights <- returnOk (mask_vm_rights R (data_to_rights rights_mask));
check_vp_alignment pgsz vaddr;
entries <- create_mapping_entries (addrFromPPtr p) vaddr pgsz vm_rights (attribs_from_word attr) pd;
ensure_safe_mapping entries;
returnOk $ InvokePage $ PageMap asid (ArchObjectCap $ PageCap dev p R pgsz (Some (asid, vaddr))) slot entries
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageUnmap then returnOk $ InvokePage $ PageUnmap cap slot else if isPageFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE (asid, vaddr) <- case mapped_address of None \<Rightarrow> throwError IllegalOperation | Some x \<Rightarrow> returnOk x;
pd <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (end \<le> start) $ throwError $ InvalidArgument 1;
page_size <- returnOk $ 1 << pageBitsForSize pgsz;
whenE (page_size \<le> start \<or> page_size < end) $ throwError $ InvalidArgument 0;
returnOk $ InvokePage $ PageFlush (label_to_flush_type (invocation_type label)) (start + vaddr) (end + vaddr - 1) (addrFromPPtr p + start) pd asid
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageGetAddress then returnOk $ InvokePage $ PageGetAddr p else throwError IllegalOperation | PageTableCap p mapped_address \<Rightarrow> if invocation_type label = ArchInvocationLabel ARMPageTableMap then if 1 < length args \<and> 0 < length excaps then let vaddr = args ! 0; attr = args ! 1; pd_cap = fst (excaps ! 0) in doE whenE (mapped_address \<noteq> None) $ throwError $ InvalidCapability 0;
(pd, asid) <- case pd_cap of ArchObjectCap (PageDirectoryCap pd None) \<Rightarrow> throwError $ InvalidCapability 1 | ArchObjectCap (PageDirectoryCap pd (Some asid)) \<Rightarrow> returnOk (pd, asid) | ArchObjectCap _ \<Rightarrow> throwError $ InvalidCapability 1 | _ \<Rightarrow> throwError $ InvalidCapability 1;
whenE (kernel_base \<le> vaddr) $ throwError $ InvalidArgument 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 1;
pd_index <- returnOk (vaddr >> 20);
vaddr' <- returnOk (vaddr && ~~ mask 20);
pd_slot <- returnOk (pd + (pd_index << 2));
oldpde <- liftE $ get_master_pde pd_slot;
unlessE (oldpde = InvalidPDE) $ throwError DeleteFirst;
pde <- returnOk (PageTablePDE (addrFromPPtr p) (attribs_from_word attr \<inter> {ParityEnabled}) 0);
returnOk $ InvokePageTable $ PageTableMap (ArchObjectCap $ PageTableCap p (Some (asid, vaddr'))) slot pde pd_slot
odE else throwError TruncatedMessage else if invocation_type label = ArchInvocationLabel ARMPageTableUnmap then doE final <- liftE $ is_final_cap (ArchObjectCap cap);
unlessE final $ throwError RevokeFirst;
returnOk $ InvokePageTable $ PageTableUnmap (ArchObjectCap cap) slot
odE else throwError IllegalOperation | PageDirectoryCap x xa \<Rightarrow> if isPDFlushLabel (invocation_type label) then if 1 < length args then let start = args ! 0; end = args ! 1 in doE whenE (end \<le> start) $ throwError $ InvalidArgument 1;
whenE (kernel_base \<le> start \<or> kernel_base < end) $ throwError IllegalOperation;
(pd, asid) <- case cap of PageDirectoryCap pd None \<Rightarrow> throwError $ InvalidCapability 0 | PageDirectoryCap pd (Some asid) \<Rightarrow> returnOk (pd, asid) | _ \<Rightarrow> throwError $ InvalidCapability 0;
pd' <- lookup_error_on_failure False $ find_pd_for_asid asid;
whenE (pd' \<noteq> pd) $ throwError $ InvalidCapability 0;
(liftE $ resolve_vaddr pd start) >>=E case_option (returnOk $ InvokePageDirectory PageDirectoryNothing) (\<lambda>(frame_size, frame_base). let base_start = page_base start frame_size; base_end = page_base (end - 1) frame_size; offset = start && mask (pageBitsForSize frame_size); pstart = frame_base + offset in doE whenE (base_start \<noteq> base_end) $ throwError $ RangeError start (base_start + mask (pageBitsForSize frame_size));
returnOk $ InvokePageDirectory $ PageDirectoryFlush (label_to_flush_type (invocation_type label)) start (end - 1) pstart pd asid
odE)
odE else throwError TruncatedMessage else throwError IllegalOperation)
 2. \<And>s. (silc_inv aag st and invs and pas_refined aag and cte_wp_at ((=) (ArchObjectCap cap)) slot and (\<lambda>s. \<forall>(cap, slot)\<in>set excaps. cte_wp_at ((=) cap) slot s) and K (\<forall>(cap, slot)\<in>{(ArchObjectCap cap, slot)} \<union> set excaps. aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v))) s \<Longrightarrow> ?Q s proof (prove)
goal (1 subgoal):
 1. \<And>s. silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)) \<Longrightarrow> (\<forall>x xa. cap = ASIDPoolCap x xa \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDPoolAssign \<longrightarrow> excaps \<noteq> [] \<longrightarrow> (\<forall>xb. (\<exists>a b. excaps ! 0 = (xb, a, b)) \<longrightarrow> (\<forall>xc. xb = ArchObjectCap xc \<longrightarrow> (\<exists>x. xc = PageDirectoryCap x None) \<longrightarrow> (\<forall>s t. reads_equiv_f aag s t \<and> affects_equiv aag l s t \<longrightarrow> asid_table s (asid_high_bits_of xa) = asid_table t (asid_high_bits_of xa)) \<and> ((\<exists>y. asid_table s (asid_high_bits_of xa) = Some y) \<longrightarrow> x = the (asid_table s (asid_high_bits_of xa)) \<longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa))))))) \<and> (cap = ASIDControlCap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMASIDControlMakePool \<longrightarrow> Suc 0 < length args \<and> Suc 0 < length excaps \<longrightarrow> (\<forall>x a. (\<exists>b. excaps ! 0 = (x, a, b)) \<longrightarrow> (\<forall>s t. reads_equiv_f aag s t \<and> affects_equiv aag l s t \<longrightarrow> asid_table s = asid_table t) \<and> (- dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {} \<longrightarrow> (\<forall>xa xb xc. (\<exists>xd. x = UntypedCap xa xb xc xd) \<longrightarrow> \<not> xa \<longrightarrow> (xc = pageBits \<longrightarrow> is_subject aag a) \<and> (xc = pageBits \<longrightarrow> (0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits \<longrightarrow> is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))) \<and> (is_cnode_cap (fst (excaps ! Suc 0)) \<longrightarrow> (\<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x))))))) \<and> (\<forall>x xa xb xc xd. cap = PageCap x xa xb xc xd \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageMap \<longrightarrow> 2 < length args \<and> excaps \<noteq> [] \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xe xf. x = PageDirectoryCap xe xf \<longrightarrow> (\<forall>x. xf = Some x \<longrightarrow> (xd = None \<longrightarrow> \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1 \<longrightarrow> is_subject_asid aag x \<and> ((\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xe) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xe pd_bits) \<and> (\<exists>ref. (ref \<rhd> xe) s) \<longrightarrow> vmsz_aligned (args ! 0) xc \<longrightarrow> (xc = ARMSmallPage \<longrightarrow> is_subject aag (lookup_pd_slot xe (args ! 0) && ~~ mask pd_bits)) \<and> (xc = ARMLargePage \<longrightarrow> is_subject aag (lookup_pd_slot xe (args ! 0) && ~~ mask pd_bits)) \<and> (\<exists>ref. (ref \<rhd> xe) s) \<and> is_subject aag xe \<and> is_aligned xe pd_bits \<and> args ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag))) \<and> (xd = Some (x, args ! 0) \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xe) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xe pd_bits) \<and> (\<exists>ref. (ref \<rhd> xe) s) \<longrightarrow> vmsz_aligned (args ! 0) xc \<longrightarrow> (xc = ARMSmallPage \<longrightarrow> is_subject aag (lookup_pd_slot xe (args ! 0) && ~~ mask pd_bits)) \<and> (xc = ARMLargePage \<longrightarrow> is_subject aag (lookup_pd_slot xe (args ! 0) && ~~ mask pd_bits)) \<and> (\<exists>ref. (ref \<rhd> xe) s) \<and> is_subject aag xe \<and> is_aligned xe pd_bits \<and> args ! 0 < kernel_base \<and> (\<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag)))))) \<and> (\<forall>x xa. cap = PageTableCap x xa \<longrightarrow> (invocation_type label = ArchInvocationLabel ARMPageTableMap \<longrightarrow> Suc 0 < length args \<and> excaps \<noteq> [] \<longrightarrow> xa = None \<longrightarrow> (\<forall>x. fst (excaps ! 0) = ArchObjectCap x \<longrightarrow> (\<forall>xa xb. x = PageDirectoryCap xa xb \<longrightarrow> (\<forall>x. xb = Some x \<longrightarrow> \<not> kernel_base \<le> args ! 0 \<longrightarrow> is_subject_asid aag x \<and> ((\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag x, Control, pasObjectAbs aag xa) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xa pd_bits) \<and> (\<exists>ref. (ref \<rhd> xa) s) \<longrightarrow> is_subject aag (xa + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)))))) \<and> (invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap \<longrightarrow> invocation_type label = ArchInvocationLabel ARMPageTableUnmap \<longrightarrow> silc_inv aag (?st1909 x xa) s \<and> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s \<and> aag_can_read aag (fst (?slot1909 x xa)) \<and> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel)) \<and> (\<forall>x xa. cap = PageDirectoryCap x xa \<longrightarrow> isPDFlushLabel (invocation_type label) \<longrightarrow> Suc 0 < length args \<longrightarrow> \<not> args ! Suc 0 \<le> args ! 0 \<longrightarrow> \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0 \<longrightarrow> (\<forall>xb. xa = Some xb \<longrightarrow> (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s) \<longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) \<and> (case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True))) proof (prove)
goal (29 subgoals):
 1. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa (asid_high_bits_of xa) = asid_table t (asid_high_bits_of xa)
 2. \<And>s x xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; \<exists>y. asid_table s (asid_high_bits_of xa) = Some y; x = the (asid_table s (asid_high_bits_of xa))\<rbrakk> \<Longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa)))
 3. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa = asid_table t
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 6. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 29 subgoals... proof (prove)
goal (31 subgoals):
 1. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_cap_cur_auth (?aag2232 s x xa xb xc sa t) (ArchObjectCap (ASIDPoolCap (?p2232 s x xa xb xc sa t) xa))
 2. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> reads_equiv (?aag2232 s x xa xb xc sa t) sa t
 3. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_refined (?aag2232 s x xa xb xc sa t) (?x2232 s x xa xb xc sa t)
 4. \<And>s x xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; \<exists>y. asid_table s (asid_high_bits_of xa) = Some y; x = the (asid_table s (asid_high_bits_of xa))\<rbrakk> \<Longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa)))
 5. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa = asid_table t
 6. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 7. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 8. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 31 subgoals... proof (prove)
goal (30 subgoals):
 1. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> reads_equiv aag sa t
 2. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_refined aag (?x2232 s x xa xb xc sa t)
 3. \<And>s x xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; \<exists>y. asid_table s (asid_high_bits_of xa) = Some y; x = the (asid_table s (asid_high_bits_of xa))\<rbrakk> \<Longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa)))
 4. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa = asid_table t
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 6. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 7. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 30 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>s x xa xb xc sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_refined aag (?x2232 s x xa xb xc sa t)
 2. \<And>s x xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; \<exists>y. asid_table s (asid_high_bits_of xa) = Some y; x = the (asid_table s (asid_high_bits_of xa))\<rbrakk> \<Longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa)))
 3. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa = asid_table t
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 6. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>s x xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDPoolCap x xa; invocation_type label = ArchInvocationLabel ARMASIDPoolAssign; excaps \<noteq> []; \<exists>a b. excaps ! 0 = (xb, a, b); xb = ArchObjectCap xc; \<exists>x. xc = PageDirectoryCap x None; \<exists>y. asid_table s (asid_high_bits_of xa) = Some y; x = the (asid_table s (asid_high_bits_of xa))\<rbrakk> \<Longrightarrow> is_subject aag (the (asid_table s (asid_high_bits_of xa)))
 2. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa = asid_table t
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> asid_table sa = asid_table t
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
A total of 27 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_cap_cur_auth aag (ArchObjectCap ASIDControlCap)
 2. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> reads_equiv aag sa t
 3. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_refined aag (?x2278 s x a sa t)
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 6. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> reads_equiv aag sa t
 2. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_refined aag (?x2278 s x a sa t)
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>s x a sa t. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); reads_equiv_f aag sa t \<and> affects_equiv aag l sa t\<rbrakk> \<Longrightarrow> pas_refined aag (?x2278 s x a sa t)
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits\<rbrakk> \<Longrightarrow> is_subject aag a
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc b xd. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; cap = ASIDControlCap; excaps ! 0 = (UntypedCap xa xb pageBits xd, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> is_subject aag a
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc b xd. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; cap = ASIDControlCap; excaps ! 0 = (UntypedCap xa xb pageBits xd, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc b xd. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; cap = ASIDControlCap; excaps ! 0 = (UntypedCap xa xb pageBits xd, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> 0 < length excaps
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 25 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (obj_ref_of (fst (excaps ! Suc 0)))
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> pas_refined aag (?s2343 s x a xa xb xc)
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (fst (snd (excaps ! Suc 0)))
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (fst (excaps ! Suc 0))) (snd (excaps ! Suc 0)) (?s2343 s x a xa xb xc)
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_cnode_cap (fst (excaps ! Suc 0))
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 6. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (fst (snd (excaps ! Suc 0)))
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (fst (excaps ! Suc 0))) (snd (excaps ! Suc 0)) s
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_cnode_cap (fst (excaps ! Suc 0))
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 5. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (fst (excaps ! Suc 0))) (snd (excaps ! Suc 0)) s
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_cnode_cap (fst (excaps ! Suc 0))
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 4. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0)); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_cnode_cap (fst (excaps ! Suc 0))
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 3. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; 0 < unat (args ! Suc 0) \<and> unat (args ! Suc 0) \<le> word_bits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 2. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>s x a xa xb xc. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = ASIDControlCap; invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; Suc 0 < length args \<and> Suc 0 < length excaps; \<exists>b. excaps ! 0 = (x, a, b); - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<exists>xd. x = UntypedCap xa xb xc xd; \<not> xa; xc = pageBits; is_cnode_cap (fst (excaps ! Suc 0))\<rbrakk> \<Longrightarrow> \<forall>x\<in>obj_refs_ac (fst (excaps ! Suc 0)). is_subject aag x
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 24 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> is_subject aag xd
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 24 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xd
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 25 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> caps_of_state (?s2464 s x a xa xb xc xd b xe) (snd (excaps ! Suc 0)) = Some (fst (excaps ! Suc 0))
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> Control \<in> cap_auth_conferred (fst (excaps ! Suc 0))
 3. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (fst (snd (excaps ! Suc 0)))
 4. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> pas_refined aag (?s2464 s x a xa xb xc xd b xe)
 5. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> xd \<in> obj_refs_ac (fst (excaps ! Suc 0))
 6. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 29 subgoals... proof (prove)
goal (29 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (fst (excaps ! Suc 0))) (snd (excaps ! Suc 0)) (?s2464 s x a xa xb xc xd b xe)
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> Control \<in> cap_auth_conferred (fst (excaps ! Suc 0))
 3. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (fst (snd (excaps ! Suc 0)))
 4. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> pas_refined aag (?s2464 s x a xa xb xc xd b xe)
 5. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> xd \<in> obj_refs_ac (fst (excaps ! Suc 0))
 6. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 29 subgoals... proof (prove)
goal (28 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> Control \<in> cap_auth_conferred (fst (excaps ! Suc 0))
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (fst (snd (excaps ! Suc 0)))
 3. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> pas_refined aag s
 4. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> xd \<in> obj_refs_ac (fst (excaps ! Suc 0))
 5. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 28 subgoals... proof (prove)
goal (27 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (fst (snd (excaps ! Suc 0)))
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> pas_refined aag s
 3. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> xd \<in> obj_refs_ac (fst (excaps ! Suc 0))
 4. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
A total of 27 subgoals... proof (prove)
goal (26 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> pas_refined aag s
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> xd \<in> obj_refs_ac (fst (excaps ! Suc 0))
 3. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 26 subgoals... proof (prove)
goal (25 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); excaps ! Suc 0 \<in> set excaps\<rbrakk> \<Longrightarrow> xd \<in> obj_refs_ac (fst (excaps ! Suc 0))
 2. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 25 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>s x a xa xb xc xd b xe. \<lbrakk>invocation_type label = ArchInvocationLabel ARMASIDControlMakePool; - dom (asid_table s) \<inter> {x. x \<le> 2 ^ local.asid_high_bits - 1} \<noteq> {}; \<not> xa; is_cnode_cap (fst (excaps ! Suc 0)); cap = ASIDControlCap; xd \<in> obj_refs_ac (fst (excaps ! Suc 0)); excaps ! 0 = (UntypedCap xa xb pageBits xe, a, b); silc_inv aag st s; Suc 0 < length args; Suc 0 < length excaps; invs s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap ASIDControlCap)) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap ASIDControlCap); is_subject aag (fst slot); \<forall>v\<in>acap_asid' ASIDControlCap. is_subject_asid aag v; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> excaps ! Suc 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject_asid aag xh
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 22 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 23 subgoals... proof (prove)
goal (24 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_aligned xf 14
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 24 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 21 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 21 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 22 subgoals... proof (prove)
goal (23 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_aligned xf 14
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
A total of 23 subgoals... proof (prove)
goal (22 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
A total of 22 subgoals... proof (prove)
goal (21 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; \<not> kernel_base \<le> 0xFFFF + args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
A total of 21 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 19 subgoals... proof (prove)
goal (20 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
A total of 20 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
A total of 17 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; args ! 0 + (2 ^ pageBitsForSize xc - 1) && ~~ mask 29 \<noteq> kernel_base; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc)\<rbrakk> \<Longrightarrow> args ! 0 && ~~ mask 29 \<noteq> kernel_base
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
A total of 17 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> ?n2857 s x xa xb xc xd xe xf xg xh \<le> 29
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; (args ! 0 + (2 ^ pageBitsForSize xc - 1) && ~~ mask (?n2857 s x xa xb xc xd xe xf xg xh)) && ~~ mask 29 \<noteq> kernel_base; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc)\<rbrakk> \<Longrightarrow> args ! 0 && ~~ mask 29 \<noteq> kernel_base
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 18 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; (args ! 0 + (2 ^ pageBitsForSize xc - 1) && ~~ mask (?n2857 s x xa xb xc xd xe xf xg xh)) && ~~ mask 29 \<noteq> kernel_base; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc)\<rbrakk> \<Longrightarrow> args ! 0 && ~~ mask 29 \<noteq> kernel_base
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> ?n2857 s x xa xb xc xd xe xf xg xh \<le> 29
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 18 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> 2 ^ pageBitsForSize xc - 1 < 2 ^ pageBitsForSize xc
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; args ! 0 && ~~ mask 29 \<noteq> kernel_base; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc)\<rbrakk> \<Longrightarrow> args ! 0 && ~~ mask 29 \<noteq> kernel_base
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> pageBitsForSize xc \<le> 29
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 19 subgoals... proof (prove)
goal (19 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> pageBitsForSize xc < LENGTH(32)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; args ! 0 && ~~ mask 29 \<noteq> kernel_base; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc)\<rbrakk> \<Longrightarrow> args ! 0 && ~~ mask 29 \<noteq> kernel_base
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> pageBitsForSize xc \<le> 29
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
A total of 19 subgoals... proof (prove)
goal (18 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None; args ! 0 && ~~ mask 29 \<noteq> kernel_base; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc)\<rbrakk> \<Longrightarrow> args ! 0 && ~~ mask 29 \<noteq> kernel_base
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> pageBitsForSize xc \<le> 29
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 10. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
A total of 18 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>(\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); is_aligned (args ! 0) (pageBitsForSize xc); silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb xc None))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb xc None)) \<and> is_subject aag (fst slot) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc None; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = None\<rbrakk> \<Longrightarrow> pageBitsForSize xc \<le> 29
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
A total of 16 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = None; \<not> kernel_base \<le> args ! 0 + 2 ^ pageBitsForSize xc - 1; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth xb. \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
A total of 15 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
A total of 16 subgoals... proof (prove)
goal (17 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_aligned xf 14
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 9. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
A total of 17 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMSmallPage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMSmallPage; xc = ARMSmallPage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot xf (args ! 0) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 7. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
A total of 14 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 7. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
A total of 14 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (xf + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
A total of 15 subgoals... proof (prove)
goal (16 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_aligned xf 14
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 10. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
A total of 16 subgoals... proof (prove)
goal (15 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 9. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
A total of 15 subgoals... proof (prove)
goal (14 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0))))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageCap x xa xb ARMLargePage (Some (xh, args ! 0)))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xh \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb ARMLargePage (Some (xh, args ! 0)); invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap (PageDirectoryCap xf (Some xh)); xe = PageDirectoryCap xf (Some xh); xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) ARMLargePage; xc = ARMLargePage\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 7. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 8. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
A total of 14 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> xf) s
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 6. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 7. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 8. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 5. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 6. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 8. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
A total of 12 subgoals... proof (prove)
goal (13 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xf
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 5. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 6. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 7. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 8. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
A total of 13 subgoals... proof (prove)
goal (12 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 4. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 5. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 6. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 8. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 10. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
A total of 12 subgoals... proof (prove)
goal (11 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> is_aligned xf pd_bits
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 3. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 4. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 5. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 8. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 9. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 10. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
A total of 11 subgoals... proof (prove)
goal (10 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 2. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 3. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 4. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 8. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 9. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 10. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (9 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth (mask_vm_rights xb (data_to_rights (args ! Suc 0))). \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 3. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (9 subgoals):
 1. \<And>s x xa xb xc xd xe xf xg xh. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageCap x xa xb xc xd; invocation_type label = ArchInvocationLabel ARMPageMap; 2 < length args \<and> excaps \<noteq> []; fst (excaps ! 0) = ArchObjectCap xe; xe = PageDirectoryCap xf xg; xg = Some xh; xd = Some (xh, args ! 0); (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xh, Control, pasObjectAbs aag xf) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xf pd_bits) \<and> (\<exists>ref. (ref \<rhd> xf) s); vmsz_aligned (args ! 0) xc\<rbrakk> \<Longrightarrow> \<forall>a\<in>vspace_cap_rights_to_auth xb. \<forall>p\<in>ptr_range xa (pageBitsForSize xc). (pasSubject aag, a, pasObjectAbs aag p) \<in> pasPolicy aag
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 3. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (8 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 7. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (9 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject_asid aag xe
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (8 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 7. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (7 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 6. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (8 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s); excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag (xc + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 7. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (9 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s); excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_aligned xc 14
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s); excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xc
 3. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 7. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 9. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (8 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s); excaps ! 0 \<in> set excaps\<rbrakk> \<Longrightarrow> is_subject aag xc
 2. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 6. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 7. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 8. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (7 subgoals):
 1. \<And>s x xa xb xc xd xe. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label = ArchInvocationLabel ARMPageTableMap; Suc 0 < length args \<and> excaps \<noteq> []; xa = None; fst (excaps ! 0) = ArchObjectCap xb; xb = PageDirectoryCap xc xd; xd = Some xe; \<not> kernel_base \<le> args ! 0; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xe, Control, pasObjectAbs aag xc) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned xc pd_bits) \<and> (\<exists>ref. (ref \<rhd> xc) s)\<rbrakk> \<Longrightarrow> excaps ! 0 \<in> set excaps
 2. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 5. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 6. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 7. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (6 subgoals):
 1. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> silc_inv aag (?st1909 x xa) s
 2. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 4. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 5. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 6. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (5 subgoals):
 1. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> cte_wp_at ((=) (ArchObjectCap (PageTableCap x xa))) (?slot1909 x xa) s
 2. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst (?slot1909 x xa))
 3. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst (?slot1909 x xa)) \<noteq> SilcLabel
 4. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 5. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (4 subgoals):
 1. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> aag_can_read aag (fst slot)
 2. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst slot) \<noteq> SilcLabel
 3. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 4. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (3 subgoals):
 1. \<And>s x xa. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageTableCap x xa; invocation_type label \<noteq> ArchInvocationLabel ARMPageTableMap; invocation_type label = ArchInvocationLabel ARMPageTableUnmap\<rbrakk> \<Longrightarrow> pasObjectAbs aag (fst slot) \<noteq> SilcLabel
 2. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 3. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits)
 2. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageDirectoryCap x (Some xb))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xb \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag (x + (args ! 0 >> 20 << 2) && ~~ mask pd_bits)
 2. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (3 subgoals):
 1. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageDirectoryCap x (Some xb))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xb \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_aligned x 14
 2. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageDirectoryCap x (Some xb))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xb \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag x
 3. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (2 subgoals):
 1. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap (PageDirectoryCap x (Some xb))) \<and> is_subject aag (fst slot) \<and> is_subject_asid aag xb \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> is_subject aag x
 2. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (1 subgoal):
 1. \<And>s x xa xb. \<lbrakk>silc_inv aag st s \<and> invs s \<and> pas_refined aag s \<and> cte_wp_at ((=) (ArchObjectCap cap)) slot s \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s) \<and> aag_cap_auth aag (pasObjectAbs aag (fst slot)) (ArchObjectCap cap) \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>acap_asid' cap. is_subject_asid aag v) \<and> (\<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)); cap = PageDirectoryCap x xa; isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; \<not> kernel_base \<le> args ! 0 \<and> \<not> kernel_base < args ! Suc 0; xa = Some xb; (\<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag) \<and> (pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits) \<and> (\<exists>ref. (ref \<rhd> x) s)\<rbrakk> \<Longrightarrow> case kheap s (lookup_pd_slot x (args ! 0) && ~~ mask pd_bits) of None \<Rightarrow> True | Some (ArchObj (PageDirectory pd')) \<Rightarrow> case pd' (UCAST(32 \<rightarrow> 12) (lookup_pd_slot x (args ! 0) && mask pd_bits >> 2)) of PageTablePDE x y z \<Rightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x) (args ! 0) && ~~ mask pt_bits) | _ \<Rightarrow> True | Some (ArchObj _) \<Rightarrow> True | Some _ \<Rightarrow> True proof (prove)
goal (1 subgoal):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (x + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap s (x + (args ! 0 >> 20 << 2) && ~~ mask pd_bits) = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x21) (args ! 0) && ~~ mask pt_bits) proof (prove)
goal (2 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (x + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23\<rbrakk> \<Longrightarrow> is_aligned x 14
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (x + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x21) (args ! 0) && ~~ mask pt_bits) proof (prove)
goal (1 subgoal):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (x + (args ! 0 >> 20 << 2) && mask pd_bits >> 2)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x21) (args ! 0) && ~~ mask pt_bits) proof (prove)
goal (2 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>kheap s x = Some (ArchObj (PageDirectory x3)); cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v)\<rbrakk> \<Longrightarrow> is_aligned x 14
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x21) (args ! 0) && ~~ mask pt_bits) proof (prove)
goal (1 subgoal):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag (lookup_pt_slot_no_fail (ptrFromPAddr x21) (args ! 0) && ~~ mask pt_bits) proof (prove)
goal (9 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> \<exists>ref. (ref \<rhd> x) s
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pspace_aligned s
 4. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pas_refined aag s
 5. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag x
 6. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 7. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 8. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 9. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (8 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> valid_vspace_objs s
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pspace_aligned s
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pas_refined aag s
 4. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag x
 5. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 6. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 7. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 8. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (7 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pspace_aligned s
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pas_refined aag s
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag x
 4. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 5. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 6. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 7. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (6 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> pas_refined aag s
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag x
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 4. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 5. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 6. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (5 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_subject aag x
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 4. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 5. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (4 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> is_aligned x pd_bits
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 4. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (3 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> args ! 0 < kernel_base
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 3. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (2 subgoals):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> kheap s x = Some (ArchObj (PageDirectory (?pdo3655 s x xb x3 x21 ref x22 x23)))
 2. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> ?pdo3655 s x xb x3 x21 ref x22 x23 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal (1 subgoal):
 1. \<And>s x xb x3 x21 ref x22 x23. \<lbrakk>cap = PageDirectoryCap x (Some xb); isPDFlushLabel (invocation_type label); Suc 0 < length args; \<not> args ! Suc 0 \<le> args ! 0; silc_inv aag st s; \<not> kernel_base \<le> args ! 0; \<not> kernel_base < args ! Suc 0; \<forall>aag. pas_refined aag s \<longrightarrow> (pasASIDAbs aag xb, Control, pasObjectAbs aag x) \<in> pasPolicy aag; invs s; pspace_aligned s \<and> valid_vspace_objs s \<longrightarrow> is_aligned x pd_bits; (ref \<rhd> x) s; pas_refined aag s; cte_wp_at ((=) (ArchObjectCap (PageDirectoryCap x (Some xb)))) slot s; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> cte_wp_at ((=) cap) slot s; pas_cap_cur_auth aag (ArchObjectCap (PageDirectoryCap x (Some xb))); is_subject aag (fst slot); is_subject_asid aag xb; \<forall>x\<in>set excaps. case x of (cap, slot) \<Rightarrow> aag_cap_auth aag (pasObjectAbs aag (fst slot)) cap \<and> is_subject aag (fst slot) \<and> (\<forall>v\<in>cap_asid' cap. is_subject_asid aag v); x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 x22 x23; kheap s x = Some (ArchObj (PageDirectory x3))\<rbrakk> \<Longrightarrow> x3 (UCAST(32 \<rightarrow> 12) (args ! 0 >> 20)) = PageTablePDE x21 (?x3655 s x xb x3 x21 ref x22 x23) (?xa3655 s x xb x3 x21 ref x22 x23) proof (prove)
goal:
No subgoals!